| www.demonoid.is/files/details/613599/054517727/ |  172.67.185.32 | 301 Moved Permanently | 0 B |
URL HTTP/1.1www.demonoid.is/files/details/613599/054517727/ IP172.67.185.32:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /files/details/613599/054517727/ HTTP/1.1
Host: www.demonoid.is
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Date: Sun, 29 Jan 2023 17:43:30 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sun, 29 Jan 2023 18:43:30 GMT
Location: https://www.demonoid.is/files/details/613599/054517727/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JCbiUSBd54gvKvJXeGVKn783DnXZpPUyxHj1cwb5mFszZORYotvavaE2C2ZCkheKUq3yeuULEYHkd3DIWGPmgKawNSNNpL21SWkXUdaeqmmOuik7BdcCyNY4i1cga02d%2Brk%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: cloudflare
CF-RAY: 7913c53e1dd6b523-OSL
alt-svc: h2=":443"; ma=60
|
|
| r3.o.lencr.org/ |  95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hash5eb7c9bc996a0ff420e58af45526f053 8c2614832b8efe1c9da0bbd465d6f3f172d95a9e c085cf277dd0429fe15e4a4bce5595636e9f2204d5a8e77220f8bf88adf4068f
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C085CF277DD0429FE15E4A4BCE5595636E9F2204D5A8E77220F8BF88ADF4068F"
Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7841
Expires: Sun, 29 Jan 2023 19:54:11 GMT
Date: Sun, 29 Jan 2023 17:43:30 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hash3eb88dea4fe00db1182370e72683c3ab ca520abf1e91bfd2aef40c6a1270a911071e8922 d8083ee567c7b3023111dc30f32c94237df7db30d4d2daaea0a569e8a3069ad7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D8083EE567C7B3023111DC30F32C94237DF7DB30D4D2DAAEA0A569E8A3069AD7"
Last-Modified: Sat, 28 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10068
Expires: Sun, 29 Jan 2023 20:31:18 GMT
Date: Sun, 29 Jan 2023 17:43:30 GMT
Connection: keep-alive
|
|
| firefox.settings.services.mozilla.com/v1/ | 35.241.9.150 | 200 OK | 939 B |
URL HTTP/2firefox.settings.services.mozilla.com/v1/ IP35.241.9.150:0
File typeJSON data\012- , ASCII text, with very long lines (939), with no line terminators Hashdcd75ca6daca51c5e39d431468511793 07f76d3bf23d65c9110d810fa71a994e39e085d3 73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Type, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sun, 29 Jan 2023 17:35:38 GMT
content-type: application/json
age: 472
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hash302c7548412192add063ad6c8b99cf3b e5d178931a27db036ce8daae302594d3ff7050b8 fc2bd9091006189e67e8074093805ee5492ce16e1dbfba32e083abeeae34969d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "FC2BD9091006189E67E8074093805EE5492CE16E1DBFBA32E083ABEEAE34969D"
Last-Modified: Sat, 28 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11800
Expires: Sun, 29 Jan 2023 21:00:10 GMT
Date: Sun, 29 Jan 2023 17:43:30 GMT
Connection: keep-alive
|
|
| content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain | 34.160.144.191 | 200 OK | 5.3 kB |
URL HTTP/2content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain IP34.160.144.191:0
File typePEM certificate\012- , ASCII text Hash7b922915ebf1fa3639b333f994c74f24 144a3f80b98fd0652d4614f24cf6cbbee40f8938 adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: 7WNVRxbiPFDWa9KFyadvTKBshOiSkG9JMzf+WJtjC33nEpqdpOmi7RrD/SJuf9oNeEqAvX0pYy4=
x-amz-request-id: TJAGTVQV3GZ8G4NE
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 29 Jan 2023 16:50:23 GMT
age: 3187
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| ocsp.digicert.com/ |  93.184.220.29 | 200 OK | 278 B |
IP93.184.220.29:0
Hasha337b5dd219b7fa9973a72fd3be85082 b18a572f72ba217594bfa702a0e8652fdd78eeb2 d63cb93a7118c76fe230edd5c448fb763a52700e5c9ee82984634d5db2b86bc1
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5539
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 17:43:30 GMT
Etag: "63d5eb40-116"
Last-Modified: Sun, 29 Jan 2023 16:11:11 GMT
Server: ECS (amb/6B80)
X-Cache: HIT
Content-Length: 278
|
|
| contile.services.mozilla.com/v1/tiles | 34.117.237.239 | 200 OK | 12 B |
URL HTTP/2contile.services.mozilla.com/v1/tiles IP34.117.237.239:0
File typeJSON data\012- , ASCII text, with no line terminators Hash23e88fb7b99543fb33315b29b1fad9d6 a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 29 Jan 2023 17:43:30 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| ocsp.digicert.com/ | 93.184.220.29 | 200 OK | 278 B |
IP93.184.220.29:0
Hasha337b5dd219b7fa9973a72fd3be85082 b18a572f72ba217594bfa702a0e8652fdd78eeb2 d63cb93a7118c76fe230edd5c448fb763a52700e5c9ee82984634d5db2b86bc1
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5539
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 17:43:30 GMT
Last-Modified: Sun, 29 Jan 2023 16:11:11 GMT
Server: ECS (ska/F718)
X-Cache: HIT
Content-Length: 278
|
|
| firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US | 35.241.9.150 | 200 OK | 32 kB |
URL HTTP/2firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US IP35.241.9.150:0
Hash383a638812b732307ac009d396ed7f48 503b38db7cf833ecd833605b7e9f9a3861294d8c 5172a9218d16b12c93260747fe3362cb277b6ff9b5d922d0b91e772a37bd172e
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Last-Modified, ETag, Expires, Backoff, Content-Length, Cache-Control, Alert, Retry-After, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sun, 29 Jan 2023 17:41:41 GMT
age: 110
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hash16a7b6a7128312e2f985d30df18c4487 6017bff79ffb525d9c7f9f32b999b74b5dc69602 663fd12209627f08e759c2ed1c76278a5da79dae1e0b46082dd1bb44775f7a16
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "663FD12209627F08E759C2ED1C76278A5DA79DAE1E0B46082DD1BB44775F7A16"
Last-Modified: Fri, 27 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8660
Expires: Sun, 29 Jan 2023 20:07:51 GMT
Date: Sun, 29 Jan 2023 17:43:31 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 869 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hash45d3ca8102df178d97a6c37e058ff672 1903a8d1435d908b19e40d70a0ea4edd1a7b4cba 629ebcdd7c4df14d79974769dd1d76e3b35ba9d100a7f9b480ba3cf6343176fc
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DCF3A6743F45DC199093F27367644998793C4DEEB2AB17C294D9AE1D66744F31"
Last-Modified: Sat, 28 Jan 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9551
Expires: Sun, 29 Jan 2023 20:22:42 GMT
Date: Sun, 29 Jan 2023 17:43:31 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 1.2 kB |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 16x16, components 3\012- data Hashfdf227e57e1a838e452bbeadec0e1d7e 23bcbd133f31a9b866ff1f3e22e88f32be58fb07 17e75302bef17f4035212221f1e4393c356109cf4d7864facc19e384776a1ecd
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DCF3A6743F45DC199093F27367644998793C4DEEB2AB17C294D9AE1D66744F31"
Last-Modified: Sat, 28 Jan 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5658
Expires: Sun, 29 Jan 2023 19:17:49 GMT
Date: Sun, 29 Jan 2023 17:43:31 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hashf0eab9f2c0f140d52ef43d9b27048cd5 54cb1108534e17b9cc373246757b4aa555cbd7dd dcf3a6743f45dc199093f27367644998793c4deeb2ab17c294d9ae1d66744f31
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DCF3A6743F45DC199093F27367644998793C4DEEB2AB17C294D9AE1D66744F31"
Last-Modified: Sat, 28 Jan 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13522
Expires: Sun, 29 Jan 2023 21:28:53 GMT
Date: Sun, 29 Jan 2023 17:43:31 GMT
Connection: keep-alive
|
|
| pl15823710.profitablecpmgate.com/10/75/1f/10751f56c065681448ce50ea9554fbfc.js | 173.233.137.44 | 200 OK | 21 kB |
URL HTTP/1.1pl15823710.profitablecpmgate.com/10/75/1f/10751f56c065681448ce50ea9554fbfc.js IP173.233.137.44:0
File typeHTML document, ASCII text, with very long lines (60127), with no line terminators Hash92571644ee7168ce84d122c2abcaf698 5c7bf47bc107311ba38c5e0c914d4544f24ef69d 071aaf5c14a16244f0a4b5404b944c5f81c343ce1836fb943ab6ab36f6a1bd2d
GET /10/75/1f/10751f56c065681448ce50ea9554fbfc.js HTTP/1.1
Host: pl15823710.profitablecpmgate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:31 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a1c056b5d3de783ae59435d6713a485d
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| pl15826529.profitablecpmgate.com/de9fc7dcafd3f630ade863b887317d43/invoke.js | 192.243.59.12 | 200 OK | 9.3 kB |
URL HTTP/1.1pl15826529.profitablecpmgate.com/de9fc7dcafd3f630ade863b887317d43/invoke.js IP192.243.59.12:0 ASN#39572 DataWeb Global Group B.V.
File typeUnicode text, UTF-8 text, with very long lines (25105), with no line terminators Hash7276ea082a30f7fd31d19194aacadaf6 45832fcd2610dbc76abf32b07aec37da2ec7d34a 366f6d311c5b6cd4db7643dd2f9f21c5e2fbebbe6c52948a4d38a5119baeb36d
GET /de9fc7dcafd3f630ade863b887317d43/invoke.js HTTP/1.1
Host: pl15826529.profitablecpmgate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Sun, 29 Jan 2023 17:43:31 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 41384a5e18171598e6432c679fd4e9fe
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| push.services.mozilla.com/ | 100.20.3.157 | 101 Switching Protocols | 8.7 kB |
URL HTTP/1.1push.services.mozilla.com/ IP100.20.3.157:0
Hashad0522ada2f8b4d7db619a317c322387 2048fa8320438171a4cd5ec253cc7581da7a3b54 059825738bc243d2c027348299355f22d15117ee73d339be4b7a17fe0a2ce4b7
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: IzL7KZyP7BepuRIIJKmv2g==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 5/X8QPh5GT7vMEipOszSjPMov6A=
|
|
| pl15823711.profitablecpmgate.com/4f/e7/b3/4fe7b3d7c8e53ce585d7681644215776.js | 192.243.59.12 | 200 OK | 13 kB |
URL HTTP/1.1pl15823711.profitablecpmgate.com/4f/e7/b3/4fe7b3d7c8e53ce585d7681644215776.js IP192.243.59.12:0 ASN#39572 DataWeb Global Group B.V.
File typeASCII text, with very long lines (37161), with no line terminators Hashf4a31eccaf4405a3bdbc34cef2bcf134 824b159614e79f57fc967a28cf0c23e3bcd27c9f 927a0f0d3974216aa14202e949fbc3e9ac03d9bb13e41771ebffc13aa3c7d63c
GET /4f/e7/b3/4fe7b3d7c8e53ce585d7681644215776.js HTTP/1.1
Host: pl15823711.profitablecpmgate.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Sun, 29 Jan 2023 17:43:31 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 93b89b10833044919714dccc1af65a79
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| e1.o.lencr.org/ | 23.36.76.226 | 200 OK | 410 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
File typeGIF image data, version 89a, 8 x 1\012- data Hash44c181717f806ad962ea93ea911e1def d4879c6708d3798a03975658f33c3a514a9348f2 607fe95e8533267ac4d5892c14d76b0a005f6f652c137245ce63d224c5bb48f7
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "D68AA5C4B46DF86722D0CB059C7379B7EE7BF7A34D97351959032444D6830446"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6381
Expires: Sun, 29 Jan 2023 19:29:52 GMT
Date: Sun, 29 Jan 2023 17:43:31 GMT
Connection: keep-alive
|
|
| ocsp.sca1b.amazontrust.com/ | 54.230.245.110 | 200 OK | 471 B |
URL HTTP/1.1ocsp.sca1b.amazontrust.com/ IP54.230.245.110:0
Hash0e90c9d5521358d2754bbad686a2e9c1 013349b8f38535bae1e197d5d96d86d17d5a1ef0 47bb6aa901220aeab3800d1ea88eb456cfe3ea337f12c059d9549fa6bd8064ab
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Sun, 29 Jan 2023 17:43:31 GMT
Last-Modified: Sun, 29 Jan 2023 17:30:24 GMT
Server: ECS (nyb/1D25)
X-Cache: Miss from cloudfront
Via: 1.1 db0992ba349fc51d5151ec8330e36c28.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: KZrDD-ozVDCcOr-oXwKeoog09C9NKqZmRR5E8YfBsw9qQYIHHHQngw==
Age: 787
|
|
| ocsp.sca1b.amazontrust.com/ | 54.230.245.110 | 200 OK | 471 B |
URL HTTP/1.1ocsp.sca1b.amazontrust.com/ IP54.230.245.110:0
Hash0e90c9d5521358d2754bbad686a2e9c1 013349b8f38535bae1e197d5d96d86d17d5a1ef0 47bb6aa901220aeab3800d1ea88eb456cfe3ea337f12c059d9549fa6bd8064ab
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Sun, 29 Jan 2023 17:43:31 GMT
Last-Modified: Sun, 29 Jan 2023 17:32:28 GMT
Server: ECS (nyb/1D1C)
X-Cache: Miss from cloudfront
Via: 1.1 5bcfe2deda0bdbc6bade0af9b61602ca.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: lZWHXTebRnFTjvHSAK2Lgj7cFl1D8btCKsuBT-eces-7cX4HoMSHhw==
Age: 663
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hashab7c061327e6055c81b5adb4534503e3 e7881809f7bc9e808ebaffb0bf5d74515d3c4798 cace1a6a8ec55404139c82ce8310c6df4f59d6363738167f4e49fe4910086875
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACE1A6A8EC55404139C82CE8310C6DF4F59D6363738167F4E49FE4910086875"
Last-Modified: Sun, 29 Jan 2023 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17594
Expires: Sun, 29 Jan 2023 22:36:45 GMT
Date: Sun, 29 Jan 2023 17:43:31 GMT
Connection: keep-alive
|
|
| simplewebanalysis.com/stats |  35.156.167.37 | 200 OK | 40 B |
URL HTTP/2simplewebanalysis.com/stats IP35.156.167.37:0
File typeASCII text, with no line terminators Hash87124294248f33ec18bcd4d42ec9baa1 f35408e3930bb003678110c8882ae269dafa2db1 4f7efc823742d62eae4f35cbf46a503336f6746011f18f8ba5361b6c799773ae
GET /stats HTTP/1.1
Host: simplewebanalysis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.demonoid.is
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:31 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://www.demonoid.is
access-control-allow-credentials: true
set-cookie: uid_id2=4a92fc7f-eb68-4a65-92a6-726b109a2124:2:1; expires=Wed, 26 Jan 2033 17:43:31 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
|
|
| simplewebanalysis.com/stats | 35.156.167.37 | 200 OK | 40 B |
URL HTTP/2simplewebanalysis.com/stats IP35.156.167.37:0
File typeASCII text, with no line terminators Hash6bb769761f2e7f7d275f3996c00aee8d 5b8c04266f09d7c96652d21f6b1f0b6156340ddf c1211586c987e67b29c7ac6542a0f17da9a0d1262c6157508538afbef6279e71
GET /stats HTTP/1.1
Host: simplewebanalysis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.demonoid.is
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:31 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://www.demonoid.is
access-control-allow-credentials: true
set-cookie: uid_id2=afd08c4d-fbb4-4cb7-a74d-86e2aeed9b9f:1:1; expires=Wed, 26 Jan 2033 17:43:31 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
|
|
| ocsp.sca1b.amazontrust.com/ | 54.230.245.110 | 200 OK | 471 B |
URL HTTP/1.1ocsp.sca1b.amazontrust.com/ IP54.230.245.110:0
Hash0e90c9d5521358d2754bbad686a2e9c1 013349b8f38535bae1e197d5d96d86d17d5a1ef0 47bb6aa901220aeab3800d1ea88eb456cfe3ea337f12c059d9549fa6bd8064ab
POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=163397
Date: Sun, 29 Jan 2023 17:43:31 GMT
Etag: "63d67516-1d7"
Expires: Tue, 31 Jan 2023 15:06:48 GMT
Last-Modified: Sun, 29 Jan 2023 13:31:02 GMT
Server: ECS (nyb/1D14)
X-Cache: Miss from cloudfront
Via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: ryWSquZfU4dYHgAQf8sDjQAJOno8Tcito03kseKLiLTnZEBZtcF12Q==
Age: 5746
|
|
| simplewebanalysis.com/stats | 35.156.167.37 | 200 OK | 40 B |
URL HTTP/2simplewebanalysis.com/stats IP35.156.167.37:0
File typeASCII text, with no line terminators Hash9571b72c252b5695f9c6f6076a055de9 c5b8d1cc9b3dc8a81d0fbf65037106322b31b988 3ff3d371d99a0616d0bd4a306759d85253966e7214d63bce5b33312f4f3162f8
GET /stats HTTP/1.1
Host: simplewebanalysis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.demonoid.is
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:32 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://www.demonoid.is
access-control-allow-credentials: true
set-cookie: uid_id2=2687ace9-ea2a-4154-b089-2c38a5942fe5:2:1; expires=Wed, 26 Jan 2033 17:43:32 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
|
|
| e1.o.lencr.org/ | 23.36.76.226 | 200 OK | 345 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hashfe9f043829a5e5d593356b06e2ccd32d 5e77c92839918ba4506feedc700daf144976d62e d68aa5c4b46df86722d0cb059c7379b7ee7bf7a34d97351959032444d6830446
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "D68AA5C4B46DF86722D0CB059C7379B7EE7BF7A34D97351959032444D6830446"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6380
Expires: Sun, 29 Jan 2023 19:29:52 GMT
Date: Sun, 29 Jan 2023 17:43:32 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hash1629fcaa3d4589ce567db2562ecd186e 52ddfcab8f128a71859d7971ccf910d3fa4ba17f f55fd0632dbf93ce045dc962f34f19891ed5dd3bde391247fee0eca689bbf289
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F55FD0632DBF93CE045DC962F34F19891ED5DD3BDE391247FEE0ECA689BBF289"
Last-Modified: Sun, 29 Jan 2023 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9333
Expires: Sun, 29 Jan 2023 20:19:05 GMT
Date: Sun, 29 Jan 2023 17:43:32 GMT
Connection: keep-alive
|
|
| solemnvine.com/pixel/purst?dl=0&th=0&sc=0&rs=1358&rd=1358&fd=786&bv=22.10.v.9&tmpl=70 | 173.233.137.44 | 200 OK | 0 B |
URL HTTP/1.1solemnvine.com/pixel/purst?dl=0&th=0&sc=0&rs=1358&rd=1358&fd=786&bv=22.10.v.9&tmpl=70 IP173.233.137.44:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /pixel/purst?dl=0&th=0&sc=0&rs=1358&rd=1358&fd=786&bv=22.10.v.9&tmpl=70 HTTP/1.1
Host: solemnvine.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hash1c2fa82d85974c70b65007623ee82d6f f6a3de172ab74bb9376faa56ea05fe9615f9bb51 6481baf1fe39010c44da03bbff61307ad9320e6453d162fe61519773756bd1b9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6481BAF1FE39010C44DA03BBFF61307AD9320E6453D162FE61519773756BD1B9"
Last-Modified: Sat, 28 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11296
Expires: Sun, 29 Jan 2023 20:51:48 GMT
Date: Sun, 29 Jan 2023 17:43:32 GMT
Connection: keep-alive
|
|
| www.topdisplayformat.com/06c7b2fcf841f1f1ed1595a97a504f46/invoke.js | 173.233.137.36 | 200 OK | 9.8 kB |
URL HTTP/1.1www.topdisplayformat.com/06c7b2fcf841f1f1ed1595a97a504f46/invoke.js IP173.233.137.36:0
File typeexported SGML document, ASCII text, with very long lines (26935), with no line terminators Hash024087cb84629090f3d8bb6993f908bc dd689fb4d2aec727813d7cab130ddc8be27c513f fba72954e4d6a5bf8d2e6c2b6f374ce2f9051bf692a1bb4981ec8a3aeaec4ceb
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /06c7b2fcf841f1f1ed1595a97a504f46/invoke.js HTTP/1.1
Host: www.topdisplayformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: cf05fcb094988646502ea968d3a9da7d
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| www.topdisplayformat.com/c16e28ad912d77b14b7ada191de179cd/invoke.js | 173.233.137.36 | 200 OK | 9.8 kB |
URL HTTP/1.1www.topdisplayformat.com/c16e28ad912d77b14b7ada191de179cd/invoke.js IP173.233.137.36:0
File typeexported SGML document, ASCII text, with very long lines (27000), with no line terminators Hash1445793373e984c27491502fe40c679c 64d314b0e78e3b72ba4785e510e4759b23edc318 beb87844a28c9753dc5a51342bb2f06a5d2b44c03882309634e80683ce9f2a02
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /c16e28ad912d77b14b7ada191de179cd/invoke.js HTTP/1.1
Host: www.topdisplayformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 01f579b758142f3c6cda4a50202f5d83
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| shippingswimsuitflog.com/ntv.json?key=de9fc7dcafd3f630ade863b887317d43&vstc=2 | 173.233.139.164 | 200 OK | 8.3 kB |
URL HTTP/1.1shippingswimsuitflog.com/ntv.json?key=de9fc7dcafd3f630ade863b887317d43&vstc=2 IP173.233.139.164:0
File typeJSON data\012- , ASCII text, with very long lines (8324), with no line terminators Hash7de1ad63cfca5646283f9b4a74393c14 29b812d96ffc967e93844087e017ff1641ca0b51 f18d3aa716c6a102467f908ec6b436da12a06a2f9ce169f516d5fbd0407dc4ea
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /ntv.json?key=de9fc7dcafd3f630ade863b887317d43&vstc=2 HTTP/1.1
Host: shippingswimsuitflog.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.demonoid.is
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Type: application/json
Content-Length: 8324
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://www.demonoid.is
Access-Control-Allow-Origin: https://www.demonoid.is
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=15726030; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
pdhtkv=true; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
uncs=1; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
pdhtkv49=true; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
uncs49=1; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
nlecde9fc7dcafd3f630ade863b887317d43=[3254344,3955576]; expires=Sun, 29 Jan 2023 17:43:37 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 03cb98f13ef0ec763daa17c1ef39932a
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hasha459eedb73942864f93a9aa9f05fed5f 507c68d1bb29951411a8655f979c673cc8b4036a a2169da610b85f19f53330c5431ce46b733f2dc4d6492d144b5e9959812e5d29
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A2169DA610B85F19F53330C5431CE46B733F2DC4D6492D144B5E9959812E5D29"
Last-Modified: Sun, 29 Jan 2023 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17129
Expires: Sun, 29 Jan 2023 22:29:01 GMT
Date: Sun, 29 Jan 2023 17:43:32 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 762 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
File typeGIF image data, version 89a, 1 x 34\012- data Hash1d3f4d5f3236d468824a903666751c24 2690c2bf6e5ade11b7b7f85d162c7e8a456b59bc 8c27028686a37ae9949fba030e12dfb26acf0d4a59f10a572489621b53766575
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4688
Expires: Sun, 29 Jan 2023 19:01:40 GMT
Date: Sun, 29 Jan 2023 17:43:32 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 1.3 kB |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 43x34, components 3\012- data Hash4acdad41f85f342f0ddb58758612c971 1b1f8d23b408f5b92df3962671b5a596a1a56b16 ec4458d41361b68ed1af7d9ff35cedb675a9393e8732ac5cc40d72e2e40865df
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4688
Expires: Sun, 29 Jan 2023 19:01:40 GMT
Date: Sun, 29 Jan 2023 17:43:32 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 595 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
File typeGIF image data, version 89a, 17 x 1\012- data Hashdb7dbd54dbb6fb716b1566a0ffd68254 895ce4326a134c8b3d5afb26400a90682202fbd8 c011d2d050c39d866b2e2f7ca1a5f011f831fd89e2225ef60aaa94510246cfa9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C57F26C0C2E439DC2F69181E1B2F6AE371BFF9D299AF739E0047EABC8BFB5A69"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4688
Expires: Sun, 29 Jan 2023 19:01:40 GMT
Date: Sun, 29 Jan 2023 17:43:32 GMT
Connection: keep-alive
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5f0097a6-af00-4a1c-8faa-f9516e27b31a.jpeg | 34.120.237.76 | 200 OK | 4.6 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5f0097a6-af00-4a1c-8faa-f9516e27b31a.jpeg IP34.120.237.76:0
File typeGIF image data, version 89a, 1 x 14\012- data Hash3429dd3aabc356d616411258b4f79937 f3267af57c474cdd1d7a35686ce1c97bf43c5c94 f38b58ac9cb9dd38b0a61b5b1854264f34681cb775f604acd0ae5d463355f889
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5f0097a6-af00-4a1c-8faa-f9516e27b31a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 4475
x-amzn-requestid: b7b272d6-3089-4f33-89b5-5cb388640e10
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa_e6HsaIAMF5Lg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d445f8-1789f7f4264270916da323db;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:45:28 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: hAzO-IMqc1CFpiBAlRl8seIYL9UonyrBMATibovyFq5kEuaweY_VyA==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 21:56:46 GMT
age: 71206
etag: "ab4f6528594a1725934727dc7d834c028a79c609"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd9a423a9-16ee-4e3f-b9b4-34f6a469aba9.jpeg | 34.120.237.76 | 200 OK | 9.5 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd9a423a9-16ee-4e3f-b9b4-34f6a469aba9.jpeg IP34.120.237.76:0
File typeGIF image data, version 89a, 1 x 119\012- data Hash072e20ce18fa07d1450ec9aa3f031ddc 1d947abc3f8513cb3b720b72cf41571666de98df cefa48966e8bfd2ef08023a619de27b2a894704c5b8e91687f8942884e174bf9
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fd9a423a9-16ee-4e3f-b9b4-34f6a469aba9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9167
x-amzn-requestid: f644ca78-a07a-43d1-96e4-95bcdecff7fb
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fPGLfFtOIAMFp7w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cf83e2-202ca7160544acd24259bd5d;Sampled=0
x-amzn-remapped-date: Tue, 24 Jan 2023 07:08:18 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: xRwqrWS66l4qJfg2HnGphN1dbrIUod9XKW3zTk_-Km9AQRPyV2UqWg==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Sat, 28 Jan 2023 20:46:16 GMT
age: 75436
etag: "50a48e737310d3f31840db4301b25927fbcc12c5"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdf6aeac1-fd74-4724-86b5-f0e86d98c915.jpeg | 34.120.237.76 | 200 OK | 9.5 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdf6aeac1-fd74-4724-86b5-f0e86d98c915.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 43x34, components 3\012- data Hash21b995c394100fdedccac3dd72a01bb6 2fab85cf7bc08867d06d6c1d15a77f78801b883e ced29a3e491354d0f0484c717641a326e77282709f09e5f2fbb53621e9c75067
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdf6aeac1-fd74-4724-86b5-f0e86d98c915.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8652
x-amzn-requestid: 21c734f0-cd73-4691-812e-7cd3908f8f89
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fRbH4HtPIAMFUGA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d07232-291e20fb41c53db7664d04b2;Sampled=0
x-amzn-remapped-date: Wed, 25 Jan 2023 00:05:06 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: j2zDtHz3pZLHJKG3-PaITyUzHOQBEELzuDIt7sbB8X_B10OxG394tg==
via: 1.1 23206a1c229d8877bdd053c4b05f9d12.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Sun, 29 Jan 2023 06:49:29 GMT
age: 39243
etag: "8508727c97127c98b886833af28b3470306216c2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| friendshipmale.com/sfp.js | 172.64.202.23 | 200 OK | 33 kB |
URL HTTP/2friendshipmale.com/sfp.js IP172.64.202.23:0
File typeUnicode text, UTF-8 text, with very long lines (65529), with no line terminators Hashc18f08ca556f107ed2290af49a9dc0ce cffffce6567deef8cb347d102870360ce81e8d50 e9ed1ce0eb75e5c02ec4f61c715becb84fd5b4a38d1b2188ba518ad1a528c153
| Analyzer | Verdict | Alert |
|---|
| fortinet | Malware | |
GET /sfp.js HTTP/1.1
Host: friendshipmale.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:31 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: 799ce6087aa082e5dba1aa45276fb34b
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Sun, 29 Jan 2023 17:43:31 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S5yBAA1Ak%2BDmSmIXN3OnEQbGReo8rO3tpoGHruRbSdvNg0Mt8%2B7MlAzFiEVoEYqrLeTeah588fqmV%2B%2BPbnv9XpUc%2B4AkSDjUdreHK1wNXUbfndSeRaMlH3L2RjIlUHFeBNjGHgE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7913c548091f7413-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2d2bbd93-ce5c-4300-9ac3-8ccdde169701.jpeg | 34.120.237.76 | 200 OK | 6.9 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2d2bbd93-ce5c-4300-9ac3-8ccdde169701.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash7ed721e83648418f4a5d64f9d038fd1a 7a311c79e311448941a8d624c1064b1a2d97cfbd b961e73aaba814eec66532ceeafad5191371fc762b05338990e8cc9c8ecfcbff
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F2d2bbd93-ce5c-4300-9ac3-8ccdde169701.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6875
x-amzn-requestid: 5fb13e91-8750-4dd9-90a2-f1218ea6009b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fS9t2E0AoAMF_LA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d10ff2-22e819312302377c4bf698ff;Sampled=0
x-amzn-remapped-date: Wed, 25 Jan 2023 11:18:10 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: QH_-DX5fiBhfS9MVH6pJi57mqFRRPSPf0iDbp_5BHE1jUqCZvvPesQ==
via: 1.1 010c0731b9775a983eceaec0f5fa6a2e.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Sun, 29 Jan 2023 08:01:17 GMT
age: 34935
etag: "7a311c79e311448941a8d624c1064b1a2d97cfbd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fce27f1aa-8d31-4110-a47f-73de0b95926d.jpeg | 34.120.237.76 | 200 OK | 12 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fce27f1aa-8d31-4110-a47f-73de0b95926d.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash10a6491e2c1dfde68c7cd7297e70700f d0f195319825a6d3e5e50ad15b2fcab27cb65896 4d9353d5874e5ea03c25e1562db5f479c222a48db526fdd10ede7c2e6a4dd874
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fce27f1aa-8d31-4110-a47f-73de0b95926d.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11470
x-amzn-requestid: 62d61967-9380-4ca9-b11a-531425dbd2ae
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fIf6WFgAIAMF6gw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63cce042-6d9fe51029094b7f37c0a648;Sampled=0
x-amzn-remapped-date: Sun, 22 Jan 2023 07:05:38 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: rUIvvkZQ028ey3klplI-x9oZFugon5HsAWT-SN2GQo5hBeBJWqoMAg==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Sun, 29 Jan 2023 04:01:15 GMT
age: 49337
etag: "d0f195319825a6d3e5e50ad15b2fcab27cb65896"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hasha37e0f06fb7ffe78207ee5c70bb69092 0e9196de15ff2fef24079f8d89186c2237b78205 48ac08adad5a2e6515adec2731c00a3cd40ae95f08423280d4ae9cb68074e974
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "48AC08ADAD5A2E6515ADEC2731C00A3CD40AE95F08423280D4AE9CB68074E974"
Last-Modified: Sun, 29 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9235
Expires: Sun, 29 Jan 2023 20:17:27 GMT
Date: Sun, 29 Jan 2023 17:43:32 GMT
Connection: keep-alive
|
|
| shippingswimsuitflog.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSQYscRRSu3kQQPRniIbc%2BKoTZ7umZnRkjBOO6cTFu1iSyB0GorqqeLbe6q63qnp4dL4sRyXHIQdRT7ze7WTUhJD9AlFkvYSGwjah7cMFf4EH0LDMZGH1Q9d5X3zt836v3%2BW5%2BSjzk9GT9XT2QStHFZs1zX9mQCdeFddduub5X8y65GzJZalxy%2B5PL9F7zvWbNe9W9KtiWXqx7vuf5nu%2BuSCMi3V%2BcspDpg45f63i1Rr3mNxvom%2F9jmzuw1AHvnZJzkLx6bvPJY0g2RhI%2FWhZ2K9PpxbfiXNFMG%2FT4wfvJVqKLBPG8jIyDKDmYdUPbipAvF6CTg5kD6N7exAFCWRHnVx9hcjCTibC3%2F0xpqCAShPxFFL0xhBpD0jGYvg3JjwnAONauI4nvrWlT0O1nLJ2wFTn7z1%2BQRUXO%2Fn4eSfzwipJ996ZWeSZ1YtGPSsj%2BGLI7RpofIhs4kMUhWPYpJCdI4hKSl1PXUo4hozGUGIJaB%2FnkSAd55CBPHcT8xKXNTuR5rSiMgqDdYIwFAWPN9hJv8qDRjjzkbCJriCwdgqkhmNlBanawJe8eN88dL%2F4Ak%2F8Iu1nCcgc2q4jz3g56vEQhCApLUFCCQhIUGUHRK%2Fe5snVb3uPK5qE%2Fy%2FVZDsqRzrq7dF9nXZGQ3fSUvDSdyp9%2FP8WWOHG56ESsxRmNeBAtBR7lor0UhO12K%2FBbvBHAyhLSLkwND2RFXr74G1JZkTNf%2FIyQHsKqQzB5DjT3QYtRq%2B6Bbo4abQ%2BD5D4XsU605DVpwXWJNDuLbNvZVafkwlSG%2F83bEOzo8meDP64%2BPP8JmCmRmhIfyZ8IuurO6IYuyN4NXVjy%2BHqayVgO6OTjbmY0E2e%2Be0dsF9rw1WU7%2FPYNNiEm5YNbwmbXaMJl0rXk%2FhXJuTAr2jBBvl%2B1GyJcz%2B3mldwkeXpt%2Fc2V1Tg1wlqpkzGoPP5wH0xW5PmPn05X8sIghzRjmLxEnB%2BRWUDqQ7B0Bzadq7eawKh5T5g6KPJyZOrh%2FFFJAiXmmIYl7H9wOK937R10zQJodnu6iD1ToqdKUDWEzV8YZak5uvzkq0l8jVAtjEJlFvZCZdTd6Wgr8voHfVh54opm5EXCq4sw6oRRi3q8EzU6Ie34ohU2qY%2FMVuyXR8v%2FAgAA%2F%2F8BAAD%2F%2F9598OVvBAAA | 173.233.139.164 | 200 OK | 7 B |
URL HTTP/1.1shippingswimsuitflog.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSQYscRRSu3kQQPRniIbc%2BKoTZ7umZnRkjBOO6cTFu1iSyB0GorqqeLbe6q63qnp4dL4sRyXHIQdRT7ze7WTUhJD9AlFkvYSGwjah7cMFf4EH0LDMZGH1Q9d5X3zt836v3%2BW5%2BSjzk9GT9XT2QStHFZs1zX9mQCdeFddduub5X8y65GzJZalxy%2B5PL9F7zvWbNe9W9KtiWXqx7vuf5nu%2BuSCMi3V%2BcspDpg45f63i1Rr3mNxvom%2F9jmzuw1AHvnZJzkLx6bvPJY0g2RhI%2FWhZ2K9PpxbfiXNFMG%2FT4wfvJVqKLBPG8jIyDKDmYdUPbipAvF6CTg5kD6N7exAFCWRHnVx9hcjCTibC3%2F0xpqCAShPxFFL0xhBpD0jGYvg3JjwnAONauI4nvrWlT0O1nLJ2wFTn7z1%2BQRUXO%2Fn4eSfzwipJ996ZWeSZ1YtGPSsj%2BGLI7RpofIhs4kMUhWPYpJCdI4hKSl1PXUo4hozGUGIJaB%2FnkSAd55CBPHcT8xKXNTuR5rSiMgqDdYIwFAWPN9hJv8qDRjjzkbCJriCwdgqkhmNlBanawJe8eN88dL%2F4Ak%2F8Iu1nCcgc2q4jz3g56vEQhCApLUFCCQhIUGUHRK%2Fe5snVb3uPK5qE%2Fy%2FVZDsqRzrq7dF9nXZGQ3fSUvDSdyp9%2FP8WWOHG56ESsxRmNeBAtBR7lor0UhO12K%2FBbvBHAyhLSLkwND2RFXr74G1JZkTNf%2FIyQHsKqQzB5DjT3QYtRq%2B6Bbo4abQ%2BD5D4XsU605DVpwXWJNDuLbNvZVafkwlSG%2F83bEOzo8meDP64%2BPP8JmCmRmhIfyZ8IuurO6IYuyN4NXVjy%2BHqayVgO6OTjbmY0E2e%2Be0dsF9rw1WU7%2FPYNNiEm5YNbwmbXaMJl0rXk%2FhXJuTAr2jBBvl%2B1GyJcz%2B3mldwkeXpt%2Fc2V1Tg1wlqpkzGoPP5wH0xW5PmPn05X8sIghzRjmLxEnB%2BRWUDqQ7B0Bzadq7eawKh5T5g6KPJyZOrh%2FFFJAiXmmIYl7H9wOK937R10zQJodnu6iD1ToqdKUDWEzV8YZak5uvzkq0l8jVAtjEJlFvZCZdTd6Wgr8voHfVh54opm5EXCq4sw6oRRi3q8EzU6Ie34ohU2qY%2FMVuyXR8v%2FAgAA%2F%2F8BAAD%2F%2F9598OVvBAAA IP173.233.139.164:0
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSQYscRRSu3kQQPRniIbc%2BKoTZ7umZnRkjBOO6cTFu1iSyB0GorqqeLbe6q63qnp4dL4sRyXHIQdRT7ze7WTUhJD9AlFkvYSGwjah7cMFf4EH0LDMZGH1Q9d5X3zt836v3%2BW5%2BSjzk9GT9XT2QStHFZs1zX9mQCdeFddduub5X8y65GzJZalxy%2B5PL9F7zvWbNe9W9KtiWXqx7vuf5nu%2BuSCMi3V%2BcspDpg45f63i1Rr3mNxvom%2F9jmzuw1AHvnZJzkLx6bvPJY0g2RhI%2FWhZ2K9PpxbfiXNFMG%2FT4wfvJVqKLBPG8jIyDKDmYdUPbipAvF6CTg5kD6N7exAFCWRHnVx9hcjCTibC3%2F0xpqCAShPxFFL0xhBpD0jGYvg3JjwnAONauI4nvrWlT0O1nLJ2wFTn7z1%2BQRUXO%2Fn4eSfzwipJ996ZWeSZ1YtGPSsj%2BGLI7RpofIhs4kMUhWPYpJCdI4hKSl1PXUo4hozGUGIJaB%2FnkSAd55CBPHcT8xKXNTuR5rSiMgqDdYIwFAWPN9hJv8qDRjjzkbCJriCwdgqkhmNlBanawJe8eN88dL%2F4Ak%2F8Iu1nCcgc2q4jz3g56vEQhCApLUFCCQhIUGUHRK%2Fe5snVb3uPK5qE%2Fy%2FVZDsqRzrq7dF9nXZGQ3fSUvDSdyp9%2FP8WWOHG56ESsxRmNeBAtBR7lor0UhO12K%2FBbvBHAyhLSLkwND2RFXr74G1JZkTNf%2FIyQHsKqQzB5DjT3QYtRq%2B6Bbo4abQ%2BD5D4XsU605DVpwXWJNDuLbNvZVafkwlSG%2F83bEOzo8meDP64%2BPP8JmCmRmhIfyZ8IuurO6IYuyN4NXVjy%2BHqayVgO6OTjbmY0E2e%2Be0dsF9rw1WU7%2FPYNNiEm5YNbwmbXaMJl0rXk%2FhXJuTAr2jBBvl%2B1GyJcz%2B3mldwkeXpt%2Fc2V1Tg1wlqpkzGoPP5wH0xW5PmPn05X8sIghzRjmLxEnB%2BRWUDqQ7B0Bzadq7eawKh5T5g6KPJyZOrh%2FFFJAiXmmIYl7H9wOK937R10zQJodnu6iD1ToqdKUDWEzV8YZak5uvzkq0l8jVAtjEJlFvZCZdTd6Wgr8voHfVh54opm5EXCq4sw6oRRi3q8EzU6Ie34ohU2qY%2FMVuyXR8v%2FAgAA%2F%2F8BAAD%2F%2F9598OVvBAAA HTTP/1.1
Host: shippingswimsuitflog.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Cookie: u_pl=15726030; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 45728d91f9df85f52a6012b8888e0b1a
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 782 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
File typeGIF image data, version 89a, 10 x 11\012- data Hashb5fafc41d477c11177a892dd0d26ceb4 28448d741e43d38e7fe56011e11a288b4036d0f9 684b85ee4b12210ba534e1bae05b3072d870824646164c0d26f0dcca9112cd92
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "73918E35EA537C5E5422872D19580AE0B1A71311052BA4EA5A97A7ACDA546665"
Last-Modified: Sun, 29 Jan 2023 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19921
Expires: Sun, 29 Jan 2023 23:15:33 GMT
Date: Sun, 29 Jan 2023 17:43:32 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hashee545433fc455bd9987f628755305a60 26d861ed51e2e4d864cbf51f59f8553a7936fe76 73918e35ea537c5e5422872d19580ae0b1a71311052ba4ea5a97a7acda546665
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "73918E35EA537C5E5422872D19580AE0B1A71311052BA4EA5A97A7ACDA546665"
Last-Modified: Sun, 29 Jan 2023 01:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19921
Expires: Sun, 29 Jan 2023 23:15:33 GMT
Date: Sun, 29 Jan 2023 17:43:32 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hash85591bf6fcdb97a141cd2591ca02ee0d 7a6707fd82bdff55b2507e2ed894814ab77a0003 9c91f1dbb7d02e091d8dbcabae9e35eb9a932e1ddae4bb69c9448a2bbf152401
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9C91F1DBB7D02E091D8DBCABAE9E35EB9A932E1DDAE4BB69C9448A2BBF152401"
Last-Modified: Sun, 29 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19960
Expires: Sun, 29 Jan 2023 23:16:12 GMT
Date: Sun, 29 Jan 2023 17:43:32 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 1.9 kB |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 29x119, components 3\012- data Hash3965d96d0b215ec75e9668c90d88bf10 0b4f00ae28ccc06c9a84c22576650600d5798802 ca07d822f3b6d2aa66f54a803c53ccc006ea568195496b7a445ffad81f84a77d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "9C91F1DBB7D02E091D8DBCABAE9E35EB9A932E1DDAE4BB69C9448A2BBF152401"
Last-Modified: Sun, 29 Jan 2023 13:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=19960
Expires: Sun, 29 Jan 2023 23:16:12 GMT
Date: Sun, 29 Jan 2023 17:43:32 GMT
Connection: keep-alive
|
|
| cdn.cloudimagesb.com/si/06/17/a0/0617a061e6a71952b94e88ab57d30d21/1674471968.png | 45.133.44.10 | 200 OK | 78 kB |
URL HTTP/2cdn.cloudimagesb.com/si/06/17/a0/0617a061e6a71952b94e88ab57d30d21/1674471968.png IP45.133.44.10:0 ASN#39572 DataWeb Global Group B.V.
File typePNG image data, 320 x 240, 8-bit/color RGBA, non-interlaced\012- data Hash489907c95d7afef0cc236fad317a1112 6ba0470a7e9fdf90fcc481e31f8866ea7d4fb063 2030387c9affa0ca884585bb770bb8577acbde75c63ee9005c318b676a769142
GET /si/06/17/a0/0617a061e6a71952b94e88ab57d30d21/1674471968.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:32 GMT
content-type: image/png
content-length: 78315
server: nginx/1.17.6
last-modified: Mon, 23 Jan 2023 11:06:17 GMT
etag: "63ce6a29-131eb"
expires: Tue, 31 Jan 2023 17:43:32 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| shippingswimsuitflog.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSQYscRRSu3kQQPRniIbc%2BKoTZ7umZnRkjBOO6cTFu1iSyB0GorqqeLbe6q63qnp4dL4sRyXHIQdRT7ze7WTUhJD9AlFkvYSGwjah7cMFf4EH0LDMZGH1Q9d5X3zt836v3%2BW5%2BSjzk9GT9XT2QStHFZs1zX9mQCdeFddduub5X8y65GzJZalxy%2B5PL9F7zvWbNe9W9KtiWXqx7vuf5nu%2BuSCMi3V%2BcspDpg45f63i1Rr3mNxvom%2F9jmzuw1AHvnZJzkLx6bvPJY0g2RhI%2FWhZ2K9PpxbfiXNFMG%2FT4wfvJVqKLBPG8jIyDKDmYdUPbipAvF6CTg5kD6N7exAFCWRHnVx9hcjCTibC3%2F0xpqCAShPxFFL0xhBpD0jGYvg3JjwnAONauI4nvrWlT0O1nLJ2wFTn7z1%2BQRUXO%2Fn4eSfzwipJ996ZWeSZ1YtGPSsj%2BGLI7RpofIhs4kMUhWPYpJCdI4hKSl1PXUo4hozGUGIJaB%2FnkSAd55CBPHcT8xKXNTuR5rSiMgqDdYIwFAWPN9hJv8qDRjjzkbCJriCwdgqkhmNlBanawJe8eN88dL%2F4Ak%2F8Iu1nCcgc2q4jz3g56vEQhCApLUFCCQhIUGUHRK%2Fe5snVb3uPK5qE%2Fy%2FVZDsqRzrq7dF9nXZGQ3fSUvDSdyp9%2FP8WWOHG56ESsxRmNeBAtBR7lor0UhO12K%2FBbvBHAyhLSLkwND2RFXr74G1JZkTNf%2FIyQHsKqQzB5DjT3QYtRq%2B6Bbo4abQ%2BD5D4XsU605DVpwXWJNDuLbNvZVafkwlSG%2F83bEOzo8meDP64%2BPP8JmCmRmhIfyZ8IuurO6IYuyN4NXVjy%2BHqayVgO6OTjbmY0E2e%2Be0dsF9rw1WU7%2FPYNNiEm5YNbwmbXaMJl0rXk%2FhXJuTAr2jBBvl%2B1GyJcz%2B3mldwkeXpt%2Fc2V1Tg1wlqpkzGoPP5wH0xW5PmPn05X8sIghzRjmLxEnB%2BRWUDqQ7B0Bzadq7eawKh5T5g6KPJyZOrh%2FFFJAiXmmIYl7H9wOK937R10zQJodnu6iD1ToqdKUDWEzV8YZak5uvzkq0l8jVAtjEJlFvZCZdTd6Wgr8voHfVh54jb9hmiH7RbjPBSM%2B6160A48r855o9URfgeZrdgvj5b%2FBQAA%2F%2F8BAAD%2F%2F8p1fgNvBAAA | 173.233.139.164 | 200 OK | 365 B |
URL HTTP/1.1shippingswimsuitflog.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSQYscRRSu3kQQPRniIbc%2BKoTZ7umZnRkjBOO6cTFu1iSyB0GorqqeLbe6q63qnp4dL4sRyXHIQdRT7ze7WTUhJD9AlFkvYSGwjah7cMFf4EH0LDMZGH1Q9d5X3zt836v3%2BW5%2BSjzk9GT9XT2QStHFZs1zX9mQCdeFddduub5X8y65GzJZalxy%2B5PL9F7zvWbNe9W9KtiWXqx7vuf5nu%2BuSCMi3V%2BcspDpg45f63i1Rr3mNxvom%2F9jmzuw1AHvnZJzkLx6bvPJY0g2RhI%2FWhZ2K9PpxbfiXNFMG%2FT4wfvJVqKLBPG8jIyDKDmYdUPbipAvF6CTg5kD6N7exAFCWRHnVx9hcjCTibC3%2F0xpqCAShPxFFL0xhBpD0jGYvg3JjwnAONauI4nvrWlT0O1nLJ2wFTn7z1%2BQRUXO%2Fn4eSfzwipJ996ZWeSZ1YtGPSsj%2BGLI7RpofIhs4kMUhWPYpJCdI4hKSl1PXUo4hozGUGIJaB%2FnkSAd55CBPHcT8xKXNTuR5rSiMgqDdYIwFAWPN9hJv8qDRjjzkbCJriCwdgqkhmNlBanawJe8eN88dL%2F4Ak%2F8Iu1nCcgc2q4jz3g56vEQhCApLUFCCQhIUGUHRK%2Fe5snVb3uPK5qE%2Fy%2FVZDsqRzrq7dF9nXZGQ3fSUvDSdyp9%2FP8WWOHG56ESsxRmNeBAtBR7lor0UhO12K%2FBbvBHAyhLSLkwND2RFXr74G1JZkTNf%2FIyQHsKqQzB5DjT3QYtRq%2B6Bbo4abQ%2BD5D4XsU605DVpwXWJNDuLbNvZVafkwlSG%2F83bEOzo8meDP64%2BPP8JmCmRmhIfyZ8IuurO6IYuyN4NXVjy%2BHqayVgO6OTjbmY0E2e%2Be0dsF9rw1WU7%2FPYNNiEm5YNbwmbXaMJl0rXk%2FhXJuTAr2jBBvl%2B1GyJcz%2B3mldwkeXpt%2Fc2V1Tg1wlqpkzGoPP5wH0xW5PmPn05X8sIghzRjmLxEnB%2BRWUDqQ7B0Bzadq7eawKh5T5g6KPJyZOrh%2FFFJAiXmmIYl7H9wOK937R10zQJodnu6iD1ToqdKUDWEzV8YZak5uvzkq0l8jVAtjEJlFvZCZdTd6Wgr8voHfVh54jb9hmiH7RbjPBSM%2B6160A48r855o9URfgeZrdgvj5b%2FBQAA%2F%2F8BAAD%2F%2F8p1fgNvBAAA IP173.233.139.164:0
File typeGIF image data, version 89a, 10 x 30\012- data Hashd3ddc5e4c371256abe8cc19315035313 9db35b97426eeb2d4f061ca5b09b38e363ff801a 44c9d7bbea24572273f54d70e0f260a4b4fe917f8efd33bb698493d6d7e8c015
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSQYscRRSu3kQQPRniIbc%2BKoTZ7umZnRkjBOO6cTFu1iSyB0GorqqeLbe6q63qnp4dL4sRyXHIQdRT7ze7WTUhJD9AlFkvYSGwjah7cMFf4EH0LDMZGH1Q9d5X3zt836v3%2BW5%2BSjzk9GT9XT2QStHFZs1zX9mQCdeFddduub5X8y65GzJZalxy%2B5PL9F7zvWbNe9W9KtiWXqx7vuf5nu%2BuSCMi3V%2BcspDpg45f63i1Rr3mNxvom%2F9jmzuw1AHvnZJzkLx6bvPJY0g2RhI%2FWhZ2K9PpxbfiXNFMG%2FT4wfvJVqKLBPG8jIyDKDmYdUPbipAvF6CTg5kD6N7exAFCWRHnVx9hcjCTibC3%2F0xpqCAShPxFFL0xhBpD0jGYvg3JjwnAONauI4nvrWlT0O1nLJ2wFTn7z1%2BQRUXO%2Fn4eSfzwipJ996ZWeSZ1YtGPSsj%2BGLI7RpofIhs4kMUhWPYpJCdI4hKSl1PXUo4hozGUGIJaB%2FnkSAd55CBPHcT8xKXNTuR5rSiMgqDdYIwFAWPN9hJv8qDRjjzkbCJriCwdgqkhmNlBanawJe8eN88dL%2F4Ak%2F8Iu1nCcgc2q4jz3g56vEQhCApLUFCCQhIUGUHRK%2Fe5snVb3uPK5qE%2Fy%2FVZDsqRzrq7dF9nXZGQ3fSUvDSdyp9%2FP8WWOHG56ESsxRmNeBAtBR7lor0UhO12K%2FBbvBHAyhLSLkwND2RFXr74G1JZkTNf%2FIyQHsKqQzB5DjT3QYtRq%2B6Bbo4abQ%2BD5D4XsU605DVpwXWJNDuLbNvZVafkwlSG%2F83bEOzo8meDP64%2BPP8JmCmRmhIfyZ8IuurO6IYuyN4NXVjy%2BHqayVgO6OTjbmY0E2e%2Be0dsF9rw1WU7%2FPYNNiEm5YNbwmbXaMJl0rXk%2FhXJuTAr2jBBvl%2B1GyJcz%2B3mldwkeXpt%2Fc2V1Tg1wlqpkzGoPP5wH0xW5PmPn05X8sIghzRjmLxEnB%2BRWUDqQ7B0Bzadq7eawKh5T5g6KPJyZOrh%2FFFJAiXmmIYl7H9wOK937R10zQJodnu6iD1ToqdKUDWEzV8YZak5uvzkq0l8jVAtjEJlFvZCZdTd6Wgr8voHfVh54jb9hmiH7RbjPBSM%2B6160A48r855o9URfgeZrdgvj5b%2FBQAA%2F%2F8BAAD%2F%2F8p1fgNvBAAA HTTP/1.1
Host: shippingswimsuitflog.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Cookie: u_pl=15726030; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 30e0a776b8ef442607a564adc44a0a90
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| cdn.cloudimagesb.com/si/e3/45/09/e34509c88d1762ac4c86147aabde5f02/1645978523.jpg | 45.133.44.10 | 200 OK | 19 kB |
URL HTTP/2cdn.cloudimagesb.com/si/e3/45/09/e34509c88d1762ac4c86147aabde5f02/1645978523.jpg IP45.133.44.10:0 ASN#39572 DataWeb Global Group B.V.
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 17x17, components 3\012- data Hash136030906f3c562809f48ab7066f4ec0 80724bb64b59fde60d0616df4e1efdba126fe5a6 dd1fd12fec9610cead224e189706ddaaac0f0d28d41060f307a5992c8cd88c87
GET /si/e3/45/09/e34509c88d1762ac4c86147aabde5f02/1645978523.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:32 GMT
content-type: image/jpeg
content-length: 18886
server: nginx/1.17.6
last-modified: Sun, 27 Feb 2022 16:15:36 GMT
etag: "621ba3a8-49c6"
expires: Tue, 31 Jan 2023 17:43:32 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| i.postimg.cc/5yytBYVw/ccleaner-proof-3.jpg |  162.19.88.68 | 200 OK | 90 kB |
URL HTTP/2i.postimg.cc/5yytBYVw/ccleaner-proof-3.jpg IP162.19.88.68:0
File typeGIF image data, version 89a, 22 x 11\012- data Hash7d507a0c3049aa8c313d338e7d8a3053 e2cb0888a77f515303457722ad208571b8d6b26a d3c48d234ae0312c999833698b8f6f161f1f4c5e4c91efa37a2f2bd4c229e062
GET /5yytBYVw/ccleaner-proof-3.jpg HTTP/1.1
Host: i.postimg.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 29 Jan 2023 17:43:32 GMT
content-type: image/jpeg
content-length: 89993
last-modified: Mon, 14 Sep 2020 20:58:31 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| feignthat.com/watch.759978787278.js?key=06c7b2fcf841f1f1ed1595a97a504f46&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1 | 192.243.59.12 | 307 Temporary Redirect | 0 B |
URL HTTP/1.1feignthat.com/watch.759978787278.js?key=06c7b2fcf841f1f1ed1595a97a504f46&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1 IP192.243.59.12:0 ASN#39572 DataWeb Global Group B.V.
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.759978787278.js?key=06c7b2fcf841f1f1ed1595a97a504f46&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1 HTTP/1.1
Host: feignthat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.demonoid.is
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.17.6
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://www.demonoid.is
Access-Control-Allow-Origin: https://www.demonoid.is
Access-Control-Allow-Credentials: true
Location: https://feignthat.com/watch.759978787278.js?key=06c7b2fcf841f1f1ed1595a97a504f46&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1&shu=4de3430fe47dfd2079293768edc568706ef27add163b487eec752dac625ba776090aef2597fa62314a0afb337b185cabf1c8d4e39eec331bcf2e5b9633a5886e8d5f7d73b33b0bd8ed7a5fb3050dfd3d574be3&pst=1675014272&rmtc=t
Set-Cookie: u_pl=15725937; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNTcyNTkzNywiayI6IjA2YzdiMmZjZjg0MWYxZjFlZDE1OTVhOTdhNTA0ZjQ2Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzg3NzM2LCJwaWQiOjIzNTIyMCwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxOCwiYWlkIjoyMywicHQiOjQsInBrIjoicWM3eXJtMWF1aSIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6dHJ1ZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3d3dy5kZW1vbm9pZC5pcy9maWxlcy9kZXRhaWxzLzYxMzU5OS8wNTQ1MTc3MjcvIn19.y8N_88FqKdhe6HV8HUGYN3DMz5svxmnQE0BydEdm9GY; expires=Sun, 29 Jan 2023 17:44:32 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a367744e8333aeb087340e1fc808eccf
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| shippingswimsuitflog.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSPWwcRRSevYSGVFihoEFbghSdd2%2FvfHcEycIYG4vgOD%2Fggmp2ZvY8eG5nNbN7ez4aKwGU8pQCAdX6OzsGEllJlwaBzjSRJSSfEOACS9QUFAhqdOeTDE%2Baee%2FN94rve%2FN9upOdEg8ZPVl7V%2FekUnS2VvbcV9ZlzHVu3dXbru%2BVvavuuoznqlfd7vgyndd8r1b2XnWXBdvUsxXP9zzf890laUSku7MTFDJ51PTLTa9crZT9WhVd8%2F%2FeZg4sdcA7p2QGko%2Be23j2BJINEbcfLwq7merkylvtTNFUG3T4%2FnvxZqzzGO3zMjIOonh%2FOg1tR4R8XoKO96cKoDu7YwUI5Yg4v%2FgI4%2F0pTYSdvTOmoYKIEfJLyDtDCDWEpEMwfReSHxOAcaxeR9x%2BsKpNTrfOUDpGR%2BTiP39B5iNy8bfLiNsHC0p23VtaZanUsUU3KiC7Q8jWEEl2iLTnQOaHYOkdSE4QtwtIXkxUSzmEjIZQog9qHWTjIx1kkYMscdDmJy6tNSPPq0dhFASNKmMsCBirNeZ4jQfVRuQhY2NafaRJH0z1wcw2ErONTXn%2FuDZzPPsdTPY97EYByx3YdEScG9vo8AK5IMgtQU4JckmQpwR5p9jjylZs8YArm4X%2BNFemOSgGOm3t0D2dtkRMdpJT8sJkK3%2F%2B%2FSM2xYnLRTNidc5oxINoLvAoF425IGw06oFf59UAVhaQtjQR3JMj8uKVX5HIEbnw2U8I6SGsOgSTM6CZD5oP6hUPdGNQbXjoxQ%2B5aOtYS16WFlwXSNKLSLecHXVKXprQeP2DLgQ7mj94euOPT15%2BCmYKJKbAh%2FIHgpa6N7ipc7J7U%2BeWPLmepLIte3T8cbdSmooL37wjtnJt%2BMqi7X%2F9BhsD4%2FLRbWHTazTmMm5Z8nBBci7MkjZMkG9X7LoI1zK7sZCZOEuurb25tNJOjLBW6ngIOjahnAeTI3LpwvsTU7p3liHNECYr0M6OyDQg9SFYsg2bHM1%2F3Pt9%2BeDyR7CawKjzmTApIc%2BKgamE549KEihx3tOwgP1PH57XO%2FYeWqYEmt6dWLFjCnRUAar6sNnzgzQxR%2FPPvhjHlwhVaRAqU9oNlVH3R8T%2F6u2zDVt54tb8qmiEjTrjPBSM%2B%2FVK0Ag8r8J5td4UfhOpHbGfHy%2F%2BCwAA%2F%2F8BAAD%2F%2Fx5ExnVxBAAA | 173.233.139.164 | 200 OK | 7 B |
URL HTTP/1.1shippingswimsuitflog.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSPWwcRRSevYSGVFihoEFbghSdd2%2FvfHcEycIYG4vgOD%2Fggmp2ZvY8eG5nNbN7ez4aKwGU8pQCAdX6OzsGEllJlwaBzjSRJSSfEOACS9QUFAhqdOeTDE%2Baee%2FN94rve%2FN9upOdEg8ZPVl7V%2FekUnS2VvbcV9ZlzHVu3dXbru%2BVvavuuoznqlfd7vgyndd8r1b2XnWXBdvUsxXP9zzf890laUSku7MTFDJ51PTLTa9crZT9WhVd8%2F%2FeZg4sdcA7p2QGko%2Be23j2BJINEbcfLwq7merkylvtTNFUG3T4%2FnvxZqzzGO3zMjIOonh%2FOg1tR4R8XoKO96cKoDu7YwUI5Yg4v%2FgI4%2F0pTYSdvTOmoYKIEfJLyDtDCDWEpEMwfReSHxOAcaxeR9x%2BsKpNTrfOUDpGR%2BTiP39B5iNy8bfLiNsHC0p23VtaZanUsUU3KiC7Q8jWEEl2iLTnQOaHYOkdSE4QtwtIXkxUSzmEjIZQog9qHWTjIx1kkYMscdDmJy6tNSPPq0dhFASNKmMsCBirNeZ4jQfVRuQhY2NafaRJH0z1wcw2ErONTXn%2FuDZzPPsdTPY97EYByx3YdEScG9vo8AK5IMgtQU4JckmQpwR5p9jjylZs8YArm4X%2BNFemOSgGOm3t0D2dtkRMdpJT8sJkK3%2F%2B%2FSM2xYnLRTNidc5oxINoLvAoF425IGw06oFf59UAVhaQtjQR3JMj8uKVX5HIEbnw2U8I6SGsOgSTM6CZD5oP6hUPdGNQbXjoxQ%2B5aOtYS16WFlwXSNKLSLecHXVKXprQeP2DLgQ7mj94euOPT15%2BCmYKJKbAh%2FIHgpa6N7ipc7J7U%2BeWPLmepLIte3T8cbdSmooL37wjtnJt%2BMqi7X%2F9BhsD4%2FLRbWHTazTmMm5Z8nBBci7MkjZMkG9X7LoI1zK7sZCZOEuurb25tNJOjLBW6ngIOjahnAeTI3LpwvsTU7p3liHNECYr0M6OyDQg9SFYsg2bHM1%2F3Pt9%2BeDyR7CawKjzmTApIc%2BKgamE549KEihx3tOwgP1PH57XO%2FYeWqYEmt6dWLFjCnRUAar6sNnzgzQxR%2FPPvhjHlwhVaRAqU9oNlVH3R8T%2F6u2zDVt54tb8qmiEjTrjPBSM%2B%2FVK0Ag8r8J5td4UfhOpHbGfHy%2F%2BCwAA%2F%2F8BAAD%2F%2Fx5ExnVxBAAA IP173.233.139.164:0
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSPWwcRRSevYSGVFihoEFbghSdd2%2FvfHcEycIYG4vgOD%2Fggmp2ZvY8eG5nNbN7ez4aKwGU8pQCAdX6OzsGEllJlwaBzjSRJSSfEOACS9QUFAhqdOeTDE%2Baee%2FN94rve%2FN9upOdEg8ZPVl7V%2FekUnS2VvbcV9ZlzHVu3dXbru%2BVvavuuoznqlfd7vgyndd8r1b2XnWXBdvUsxXP9zzf890laUSku7MTFDJ51PTLTa9crZT9WhVd8%2F%2FeZg4sdcA7p2QGko%2Be23j2BJINEbcfLwq7merkylvtTNFUG3T4%2FnvxZqzzGO3zMjIOonh%2FOg1tR4R8XoKO96cKoDu7YwUI5Yg4v%2FgI4%2F0pTYSdvTOmoYKIEfJLyDtDCDWEpEMwfReSHxOAcaxeR9x%2BsKpNTrfOUDpGR%2BTiP39B5iNy8bfLiNsHC0p23VtaZanUsUU3KiC7Q8jWEEl2iLTnQOaHYOkdSE4QtwtIXkxUSzmEjIZQog9qHWTjIx1kkYMscdDmJy6tNSPPq0dhFASNKmMsCBirNeZ4jQfVRuQhY2NafaRJH0z1wcw2ErONTXn%2FuDZzPPsdTPY97EYByx3YdEScG9vo8AK5IMgtQU4JckmQpwR5p9jjylZs8YArm4X%2BNFemOSgGOm3t0D2dtkRMdpJT8sJkK3%2F%2B%2FSM2xYnLRTNidc5oxINoLvAoF425IGw06oFf59UAVhaQtjQR3JMj8uKVX5HIEbnw2U8I6SGsOgSTM6CZD5oP6hUPdGNQbXjoxQ%2B5aOtYS16WFlwXSNKLSLecHXVKXprQeP2DLgQ7mj94euOPT15%2BCmYKJKbAh%2FIHgpa6N7ipc7J7U%2BeWPLmepLIte3T8cbdSmooL37wjtnJt%2BMqi7X%2F9BhsD4%2FLRbWHTazTmMm5Z8nBBci7MkjZMkG9X7LoI1zK7sZCZOEuurb25tNJOjLBW6ngIOjahnAeTI3LpwvsTU7p3liHNECYr0M6OyDQg9SFYsg2bHM1%2F3Pt9%2BeDyR7CawKjzmTApIc%2BKgamE549KEihx3tOwgP1PH57XO%2FYeWqYEmt6dWLFjCnRUAar6sNnzgzQxR%2FPPvhjHlwhVaRAqU9oNlVH3R8T%2F6u2zDVt54tb8qmiEjTrjPBSM%2B%2FVK0Ag8r8J5td4UfhOpHbGfHy%2F%2BCwAA%2F%2F8BAAD%2F%2Fx5ExnVxBAAA HTTP/1.1
Host: shippingswimsuitflog.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Cookie: u_pl=15726030; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 955580eaf0b1912a5ee5b82b84729190
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| shippingswimsuitflog.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSPWwcRRSevYSGVFihoEFbghSdd%2B%2FHd0eQLIyxsQiO8wMuqGZnZs%2BD53ZWM7u356OxEkApTykQUK2%2Fs2MgkZV0aRDoTBNZQvIKAS6wRE1BgaBGdz7J8KSZ9958r%2Fi%2BN9%2BnO%2Bkp8ZDSk7V3dV8qRWfrZc99ZV1GXGfWXb3t%2Bl7Zu%2Bquy2iudtXtjS%2FTfc336mXvVXdZsE09W%2FF8z%2FM9312SRoS6NztBIeNHLb%2Fc8sq1Stmv19Az%2F%2B9t6sBSB7x7SmYgefHcxrMnkGyEqPN4UdjNRMdX3uqkiibaoMv334s2I51F6JyXoXEQRvvTaWhbEPJ5CTranyqA7u6OFSCQBXF%2B8RFE%2B1OaCLp7Z0wDBREh4JeQdUcQagRJR2D6LiQ%2FJgDjWL2OqPNgVZuMbp2hdIwW5OI%2Ff0FmBbn422VEnYMFJXvuLa3SROrIohfmkL0RZHuEOD1E0ncgs0Ow5A4kJ4g6OSTPJ6qlHEGGIygxALUO0vGRDtLQQRo76PATl9Zboec1wiCsVps1xli1yli9OcfrvFprhh5SNqY1QBIPwNQAzGwjNtvYlPeP6zPHs9%2FBpN%2FDbuSw3IFNCuLc2EaX58gEQWYJMkqQSYIsIci6%2BR5XtmLzB1zZNPCnuTLN1Xyok%2FYO3dNJW0RkJz4lL0y28uffP2JTnLhctELW4IyGvBrOVT3KRXOuGjSbjarf4LUqrMwhbWkiuC8L8uKVXxHLglz47CcE9BBWHYLJGdDUB82GjYoHujGsNT30o4dcdHSkJS9LC65zxMlFJFvOjjolL01ovP5BD4IdzR88vfHHJy8%2FBTM5YpPjQ%2FkDQVvdG97UGdm9qTNLnlyPE9mRfTr%2BuFsJTcSFb94RW5k2fGXRDr5%2Bg42BcfnotrDJNRpxGbUtebggORdmSRsmyLcrdl0Ea6ndWEhNlMbX1t5cWunERlgrdTQCHZtQzoPJgly68P7ElO6dZUgzgklzdNIjMg1IfQgWb8PGR%2FMf939fPrj8EawmMOp8JohLyNJ8aCrB%2BaOSBEqc9zTIYf%2FTB%2Bf1jr2HtimBJncnVuyaHF2Vg6oBbPr8MInN0fyzL8bxJQJVGgbKlHYDZdT9gvhfvX22YStPXFEPvVB4FRGErSBsUI%2B3wloroC1fNII69ZHYgv38ePFfAAAA%2F%2F8BAAD%2F%2FwpMSJNxBAAA | 173.233.139.164 | 200 OK | 486 B |
URL HTTP/1.1shippingswimsuitflog.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSPWwcRRSevYSGVFihoEFbghSdd%2B%2FHd0eQLIyxsQiO8wMuqGZnZs%2BD53ZWM7u356OxEkApTykQUK2%2Fs2MgkZV0aRDoTBNZQvIKAS6wRE1BgaBGdz7J8KSZ9958r%2Fi%2BN9%2BnO%2Bkp8ZDSk7V3dV8qRWfrZc99ZV1GXGfWXb3t%2Bl7Zu%2Bquy2iudtXtjS%2FTfc336mXvVXdZsE09W%2FF8z%2FM9312SRoS6NztBIeNHLb%2Fc8sq1Stmv19Az%2F%2B9t6sBSB7x7SmYgefHcxrMnkGyEqPN4UdjNRMdX3uqkiibaoMv334s2I51F6JyXoXEQRvvTaWhbEPJ5CTranyqA7u6OFSCQBXF%2B8RFE%2B1OaCLp7Z0wDBREh4JeQdUcQagRJR2D6LiQ%2FJgDjWL2OqPNgVZuMbp2hdIwW5OI%2Ff0FmBbn422VEnYMFJXvuLa3SROrIohfmkL0RZHuEOD1E0ncgs0Ow5A4kJ4g6OSTPJ6qlHEGGIygxALUO0vGRDtLQQRo76PATl9Zboec1wiCsVps1xli1yli9OcfrvFprhh5SNqY1QBIPwNQAzGwjNtvYlPeP6zPHs9%2FBpN%2FDbuSw3IFNCuLc2EaX58gEQWYJMkqQSYIsIci6%2BR5XtmLzB1zZNPCnuTLN1Xyok%2FYO3dNJW0RkJz4lL0y28uffP2JTnLhctELW4IyGvBrOVT3KRXOuGjSbjarf4LUqrMwhbWkiuC8L8uKVXxHLglz47CcE9BBWHYLJGdDUB82GjYoHujGsNT30o4dcdHSkJS9LC65zxMlFJFvOjjolL01ovP5BD4IdzR88vfHHJy8%2FBTM5YpPjQ%2FkDQVvdG97UGdm9qTNLnlyPE9mRfTr%2BuFsJTcSFb94RW5k2fGXRDr5%2Bg42BcfnotrDJNRpxGbUtebggORdmSRsmyLcrdl0Ea6ndWEhNlMbX1t5cWunERlgrdTQCHZtQzoPJgly68P7ElO6dZUgzgklzdNIjMg1IfQgWb8PGR%2FMf939fPrj8EawmMOp8JohLyNJ8aCrB%2BaOSBEqc9zTIYf%2FTB%2Bf1jr2HtimBJncnVuyaHF2Vg6oBbPr8MInN0fyzL8bxJQJVGgbKlHYDZdT9gvhfvX22YStPXFEPvVB4FRGErSBsUI%2B3wloroC1fNII69ZHYgv38ePFfAAAA%2F%2F8BAAD%2F%2FwpMSJNxBAAA IP173.233.139.164:0
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 17x17, components 3\012- data Hashe8eb978edd8fc25e738f43ee09e64ea6 58d3a626483032abff079d423376f8570b66e701 d57a33290adec93c52aec15b7f29d974d229ba8e8aa1442e43a3284f0e0fbb51
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSPWwcRRSevYSGVFihoEFbghSdd%2B%2FHd0eQLIyxsQiO8wMuqGZnZs%2BD53ZWM7u356OxEkApTykQUK2%2Fs2MgkZV0aRDoTBNZQvIKAS6wRE1BgaBGdz7J8KSZ9958r%2Fi%2BN9%2BnO%2Bkp8ZDSk7V3dV8qRWfrZc99ZV1GXGfWXb3t%2Bl7Zu%2Bquy2iudtXtjS%2FTfc336mXvVXdZsE09W%2FF8z%2FM9312SRoS6NztBIeNHLb%2Fc8sq1Stmv19Az%2F%2B9t6sBSB7x7SmYgefHcxrMnkGyEqPN4UdjNRMdX3uqkiibaoMv334s2I51F6JyXoXEQRvvTaWhbEPJ5CTranyqA7u6OFSCQBXF%2B8RFE%2B1OaCLp7Z0wDBREh4JeQdUcQagRJR2D6LiQ%2FJgDjWL2OqPNgVZuMbp2hdIwW5OI%2Ff0FmBbn422VEnYMFJXvuLa3SROrIohfmkL0RZHuEOD1E0ncgs0Ow5A4kJ4g6OSTPJ6qlHEGGIygxALUO0vGRDtLQQRo76PATl9Zboec1wiCsVps1xli1yli9OcfrvFprhh5SNqY1QBIPwNQAzGwjNtvYlPeP6zPHs9%2FBpN%2FDbuSw3IFNCuLc2EaX58gEQWYJMkqQSYIsIci6%2BR5XtmLzB1zZNPCnuTLN1Xyok%2FYO3dNJW0RkJz4lL0y28uffP2JTnLhctELW4IyGvBrOVT3KRXOuGjSbjarf4LUqrMwhbWkiuC8L8uKVXxHLglz47CcE9BBWHYLJGdDUB82GjYoHujGsNT30o4dcdHSkJS9LC65zxMlFJFvOjjolL01ovP5BD4IdzR88vfHHJy8%2FBTM5YpPjQ%2FkDQVvdG97UGdm9qTNLnlyPE9mRfTr%2BuFsJTcSFb94RW5k2fGXRDr5%2Bg42BcfnotrDJNRpxGbUtebggORdmSRsmyLcrdl0Ea6ndWEhNlMbX1t5cWunERlgrdTQCHZtQzoPJgly68P7ElO6dZUgzgklzdNIjMg1IfQgWb8PGR%2FMf939fPrj8EawmMOp8JohLyNJ8aCrB%2BaOSBEqc9zTIYf%2FTB%2Bf1jr2HtimBJncnVuyaHF2Vg6oBbPr8MInN0fyzL8bxJQJVGgbKlHYDZdT9gvhfvX22YStPXFEPvVB4FRGErSBsUI%2B3wloroC1fNII69ZHYgv38ePFfAAAA%2F%2F8BAAD%2F%2FwpMSJNxBAAA HTTP/1.1
Host: shippingswimsuitflog.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Cookie: u_pl=15726030; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 65491786c85f0faeb79ba836ffc2fcaf
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hashb9ca371a18b1afacc82e035f41dc2b86 8b4a87be43183e4f89e19ecac344915d60574950 8ac3da2f8ce052a3d27fee0dccc5712a55e917f9de8daff8db891d50249aba90
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8AC3DA2F8CE052A3D27FEE0DCCC5712A55E917F9DE8DAFF8DB891D50249ABA90"
Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18088
Expires: Sun, 29 Jan 2023 22:45:00 GMT
Date: Sun, 29 Jan 2023 17:43:32 GMT
Connection: keep-alive
|
|
| nudgeworry.com/watch.197801845861.js?key=c16e28ad912d77b14b7ada191de179cd&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1 | 192.243.59.12 | 307 Temporary Redirect | 0 B |
URL HTTP/1.1nudgeworry.com/watch.197801845861.js?key=c16e28ad912d77b14b7ada191de179cd&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1 IP192.243.59.12:0 ASN#39572 DataWeb Global Group B.V.
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.197801845861.js?key=c16e28ad912d77b14b7ada191de179cd&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1 HTTP/1.1
Host: nudgeworry.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.demonoid.is
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.17.6
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://www.demonoid.is
Access-Control-Allow-Origin: https://www.demonoid.is
Access-Control-Allow-Credentials: true
Location: https://nudgeworry.com/watch.197801845861.js?key=c16e28ad912d77b14b7ada191de179cd&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1&shu=7fec2c7069ead99b3d68615e541194a1fa7596b1238f5e6fef83cad2455984cefd6a8c6ed88fc4b9ab9fcbe45069536a1b98de78721170efe74fd090b5f19d893764d2ccc74b5895e88fc7790451b71a914fe0ae9b2195570e125d57eb30d2&pst=1675014272&rmtc=t
Set-Cookie: u_pl=15725408; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNTcyNTQwOCwiayI6ImMxNmUyOGFkOTEyZDc3YjE0YjdhZGExOTFkZTE3OWNkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzg3NzM2LCJwaWQiOjIzNTIyMCwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxOCwiYWlkIjoyNywicHQiOjQsInBrIjoiZzRpYXgwcGF1IiwiY3BrcyI6eyAiMjgiOiI1YzM1NzJlYzNhMjgwMmM3ZmFkNDcyY2QyYWUyMTUzYiIsIjI5IjoiODgxMTBjYjkzMjk0ZmQ4MjRjMDZkYzhjZTNjNzkxMDQifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjkwNzUzNDU3LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTIwNjI1LCJibiI6IkZpcmVmb3giLCJidiI6IjEwNS4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vd3d3LmRlbW9ub2lkLmlzL2ZpbGVzL2RldGFpbHMvNjEzNTk5LzA1NDUxNzcyNy8ifX0.iJrhLxIqt3vQ4YAOG7shmFHSQJAFEcaws_b6mAZIW3g; expires=Sun, 29 Jan 2023 17:44:32 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d3508f5f0a738dd6d0f3e15d21da0d73
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| feignthat.com/watch.759978787278.js?key=06c7b2fcf841f1f1ed1595a97a504f46&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1&shu=4de3430fe47dfd2079293768edc568706ef27add163b487eec752dac625ba776090aef2597fa62314a0afb337b185cabf1c8d4e39eec331bcf2e5b9633a5886e8d5f7d73b33b0bd8ed7a5fb3050dfd3d574be3&pst=1675014272&rmtc=t | 192.243.59.12 | 200 OK | 2.0 kB |
URL HTTP/1.1feignthat.com/watch.759978787278.js?key=06c7b2fcf841f1f1ed1595a97a504f46&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1&shu=4de3430fe47dfd2079293768edc568706ef27add163b487eec752dac625ba776090aef2597fa62314a0afb337b185cabf1c8d4e39eec331bcf2e5b9633a5886e8d5f7d73b33b0bd8ed7a5fb3050dfd3d574be3&pst=1675014272&rmtc=t IP192.243.59.12:0 ASN#39572 DataWeb Global Group B.V.
File typeHTML document, ASCII text, with very long lines (2504) Hash9684fff9a01652d02ca59b00f07ac9d2 cdd2c0cf1ebf0fa916b4e71efcf57d00daf425e0 9e976a0f9a7ed0aece106da6bf9ec1f2c36f9c01504c4dfaeffc777d85e420e9
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.759978787278.js?key=06c7b2fcf841f1f1ed1595a97a504f46&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1&shu=4de3430fe47dfd2079293768edc568706ef27add163b487eec752dac625ba776090aef2597fa62314a0afb337b185cabf1c8d4e39eec331bcf2e5b9633a5886e8d5f7d73b33b0bd8ed7a5fb3050dfd3d574be3&pst=1675014272&rmtc=t HTTP/1.1
Host: feignthat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.demonoid.is
Referer: https://www.demonoid.is/
Connection: keep-alive
Cookie: u_pl=15725937; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNTcyNTkzNywiayI6IjA2YzdiMmZjZjg0MWYxZjFlZDE1OTVhOTdhNTA0ZjQ2Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzg3NzM2LCJwaWQiOjIzNTIyMCwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxOCwiYWlkIjoyMywicHQiOjQsInBrIjoicWM3eXJtMWF1aSIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo5MDc1MzQ1NywiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjM4OTE0LCJvbiI6IldpbmRvd3MiLCJvdiI6IjEwLjAiLCJiaWQiOjEyMDYyNSwiYm4iOiJGaXJlZm94IiwiYnYiOiIxMDUuMCIsInd2IjpmYWxzZSwiZSI6dHJ1ZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3d3dy5kZW1vbm9pZC5pcy9maWxlcy9kZXRhaWxzLzYxMzU5OS8wNTQ1MTc3MjcvIn19.y8N_88FqKdhe6HV8HUGYN3DMz5svxmnQE0BydEdm9GY
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://www.demonoid.is
Access-Control-Allow-Origin: https://www.demonoid.is
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=2687ace9-ea2a-4154-b089-2c38a5942fe5:2:1; expires=Sun, 05 Feb 2023 17:43:32 GMT; secure; SameSite=None
pdhtkv=true; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
uncs=1; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
pdhtkv23=true; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
uncs23=1; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: eb6e6e6e74600e8d5d404fe6d67321e2
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| experimentalconcerningsuck.com/sbar.json?key=4fe7b3d7c8e53ce585d7681644215776&uuid=4a92fc7f-eb68-4a65-92a6-726b109a2124%3A2%3A1 | 192.243.61.225 | 200 OK | 3.6 kB |
URL HTTP/1.1experimentalconcerningsuck.com/sbar.json?key=4fe7b3d7c8e53ce585d7681644215776&uuid=4a92fc7f-eb68-4a65-92a6-726b109a2124%3A2%3A1 IP192.243.61.225:0 ASN#39572 DataWeb Global Group B.V.
File typeJSON data\012- , ASCII text, with very long lines (6199), with no line terminators Hash726cc72dfd931748d9cfa209efec8e1f 284b155cd0d83a1fc10fc2f3f5af6c3acd1862e2 89b1bf93596303f28ddfa53606613d3dc9340fb7b9cb6060befa59e4e458c538
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /sbar.json?key=4fe7b3d7c8e53ce585d7681644215776&uuid=4a92fc7f-eb68-4a65-92a6-726b109a2124%3A2%3A1 HTTP/1.1
Host: experimentalconcerningsuck.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.demonoid.is
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://www.demonoid.is
Access-Control-Allow-Origin: https://www.demonoid.is
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=15723212; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
uid_id2=4a92fc7f-eb68-4a65-92a6-726b109a2124:2:1; expires=Sun, 05 Feb 2023 17:43:32 GMT; secure; SameSite=None
pdhtkv=true; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
uncs=1; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
pdhtkv29=true; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
uncs29=1; expires=Mon, 30 Jan 2023 17:43:32 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 05c08f8db3315b8027a61a350e5072b3
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| nudgeworry.com/5c/35/72/5c3572ec3a2802c7fad472cd2ae2153b.js | 192.243.59.12 | 200 OK | 29 kB |
URL HTTP/1.1nudgeworry.com/5c/35/72/5c3572ec3a2802c7fad472cd2ae2153b.js IP192.243.59.12:0 ASN#39572 DataWeb Global Group B.V.
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (65536), with no line terminators Hash78bd1596d972827f379309fc8795cf74 620ffeda2884d61c73b98aff00dbeb23fc8d3126 c9ae2d126ca64e000e6e9e2266bdf438eec5dc1df0ea3939a84ddb6f211b5492
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /5c/35/72/5c3572ec3a2802c7fad472cd2ae2153b.js HTTP/1.1
Host: nudgeworry.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: b74824e730f14ef892d4edd5f1067650
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| banquetunarmedgrater.com/advertisers.js | 173.233.137.44 | 200 OK | 0 B |
URL HTTP/1.1banquetunarmedgrater.com/advertisers.js IP173.233.137.44:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /advertisers.js HTTP/1.1
Host: banquetunarmedgrater.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:32 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0a098baf327ad2f2c780018fd873fee1
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| cdn.cloudimagesb.com/bi/ef/03/ae/ef03ae703d9cec11e4c0336f00fc688a/1632787324.jpg | 45.133.44.10 | 200 OK | 78 kB |
URL HTTP/2cdn.cloudimagesb.com/bi/ef/03/ae/ef03ae703d9cec11e4c0336f00fc688a/1632787324.jpg IP45.133.44.10:0 ASN#39572 DataWeb Global Group B.V.
File typeJPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 22.5 (Windows), datetime=2021:09:24 12:00:24], baseline, precision 8, 728x90, components 3\012- data Hashb20dfb5a86fe37b002166416652f0d2d aede231ca0c3bb22cfd4de3e6290876f829e3733 f369c7bc88c073fa3311e1d2c2ee4ecd2f6d0b080fc426519c83a72e3aafff06
GET /bi/ef/03/ae/ef03ae703d9cec11e4c0336f00fc688a/1632787324.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:33 GMT
content-type: image/jpeg
content-length: 78058
server: nginx/1.17.6
last-modified: Tue, 28 Sep 2021 00:02:14 GMT
etag: "61525b86-130ea"
expires: Tue, 31 Jan 2023 17:43:33 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hashe34c204daf6f65e512d7168b01268c76 793aacf3316ca30d6bef3acaaf097e42e2013e49 a748e66ab50d8c910a381a0e653c9b3e95c15043c5c52e91fbaeb20282b9fd49
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A748E66AB50D8C910A381A0E653C9B3E95C15043C5C52E91FBAEB20282B9FD49"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8186
Expires: Sun, 29 Jan 2023 19:59:59 GMT
Date: Sun, 29 Jan 2023 17:43:33 GMT
Connection: keep-alive
|
|
| nudgeworry.com/watch.197801845861.js?key=c16e28ad912d77b14b7ada191de179cd&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1&shu=7fec2c7069ead99b3d68615e541194a1fa7596b1238f5e6fef83cad2455984cefd6a8c6ed88fc4b9ab9fcbe45069536a1b98de78721170efe74fd090b5f19d893764d2ccc74b5895e88fc7790451b71a914fe0ae9b2195570e125d57eb30d2&pst=1675014272&rmtc=t | 192.243.59.12 | 200 OK | 2.1 kB |
URL HTTP/1.1nudgeworry.com/watch.197801845861.js?key=c16e28ad912d77b14b7ada191de179cd&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1&shu=7fec2c7069ead99b3d68615e541194a1fa7596b1238f5e6fef83cad2455984cefd6a8c6ed88fc4b9ab9fcbe45069536a1b98de78721170efe74fd090b5f19d893764d2ccc74b5895e88fc7790451b71a914fe0ae9b2195570e125d57eb30d2&pst=1675014272&rmtc=t IP192.243.59.12:0 ASN#39572 DataWeb Global Group B.V.
File typeHTML document, ASCII text, with very long lines (2532) Hashd1211b6579aaafc48b800c2bde93ee90 f604caed58977466bba99efab988255180761be9 e381e4038902f6d06da9ea31cb6117c64e3560ceccf7550dc8d8989e98fdc075
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /watch.197801845861.js?key=c16e28ad912d77b14b7ada191de179cd&kw=%5B%22ccleaner%22%2C%22professional%22%2C%22v6%22%2C%2208%22%2C%2210255%22%2C%22portable%22%2C%22cracked%22%2C%22crackshash%22%2C%22-%22%2C%22demonoid%22%5D&refer=https%3A%2F%2Fwww.demonoid.is%2Ffiles%2Fdetails%2F613599%2F054517727%2F&tz=0&dev=e&res=12.1055&uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5%3A2%3A1&shu=7fec2c7069ead99b3d68615e541194a1fa7596b1238f5e6fef83cad2455984cefd6a8c6ed88fc4b9ab9fcbe45069536a1b98de78721170efe74fd090b5f19d893764d2ccc74b5895e88fc7790451b71a914fe0ae9b2195570e125d57eb30d2&pst=1675014272&rmtc=t HTTP/1.1
Host: nudgeworry.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.demonoid.is
Referer: https://www.demonoid.is/
Connection: keep-alive
Cookie: u_pl=15725408; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNTcyNTQwOCwiayI6ImMxNmUyOGFkOTEyZDc3YjE0YjdhZGExOTFkZTE3OWNkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzg3NzM2LCJwaWQiOjIzNTIyMCwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxOCwiYWlkIjoyNywicHQiOjQsInBrIjoiZzRpYXgwcGF1IiwiY3BrcyI6eyAiMjgiOiI1YzM1NzJlYzNhMjgwMmM3ZmFkNDcyY2QyYWUyMTUzYiIsIjI5IjoiODgxMTBjYjkzMjk0ZmQ4MjRjMDZkYzhjZTNjNzkxMDQifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjkwNzUzNDU3LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTIwNjI1LCJibiI6IkZpcmVmb3giLCJidiI6IjEwNS4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vd3d3LmRlbW9ub2lkLmlzL2ZpbGVzL2RldGFpbHMvNjEzNTk5LzA1NDUxNzcyNy8ifX0.iJrhLxIqt3vQ4YAOG7shmFHSQJAFEcaws_b6mAZIW3g
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Sun, 29 Jan 2023 17:43:33 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://www.demonoid.is
Access-Control-Allow-Origin: https://www.demonoid.is
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=2687ace9-ea2a-4154-b089-2c38a5942fe5:2:1; expires=Sun, 05 Feb 2023 17:43:32 GMT; secure; SameSite=None
pdhtkv=true; expires=Mon, 30 Jan 2023 17:43:33 GMT; secure; SameSite=None
uncs=1; expires=Mon, 30 Jan 2023 17:43:33 GMT; secure; SameSite=None
pdhtkv27=true; expires=Mon, 30 Jan 2023 17:43:33 GMT; secure; SameSite=None
uncs27=1; expires=Mon, 30 Jan 2023 17:43:33 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 44537e302c6bba16aed500ee5d514b85
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| experimentalconcerningsuck.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSv28cRRueTfI1XyosKCgQV1CAFJ9393bvR1xEGGNkEWwrCViiQbMzs%2BfBczurmd3bs5XCIhJKg3RQAOX6OTsWxELJH4BAZxpkGh8IcIHpaSiQqNGdTzp4i32fZ5%2B3eN5n3g%2F38wviIqfnG2%2FpXakUXQirbuXlTZlwXdjK2r2K51bdxcqmTOrBYqU3%2FpjuTc8Nq%2B4rlTcE29YLvuu5rud6lRVpRKx7CxMVMj1uedWWWw38qhcG6Jn%2Fcps7sNQB716QOUg%2B%2Bt%2FW908h2RBJ58mysNuZTm%2B83skVzbRBlx%2B9nWwnukjQmcHYOIiTo%2Bk0tB0R8vkV6ORougF092C8ASI5Is4vHqLkaGoTUffw0mmkIBJE%2FDqK7hBCDSHpEEw%2FgORnBGAca%2BtIOo%2FWtCnozqVKx%2BqIXPv7L8hiRK799iySzldLSvYqd7XKM6kTi15cQvaGkO0h0vwE2a4DWZyAZR9AcoKkU0Ly85cC2vJj1ojnRVRvzge0Hs63fFqfb%2Fj1yHNb1Pf8YBKNlEPIeAgl%2BqD2CnLrIJcO8thBnjro8PMKDVux6zbiKK7VmgFjrFZjLGzWechrQTN2kbOx9z6ytA%2Bm%2BmBmD6nZw7b85CycO1v4Bib%2FFnarhOUObEbQ5SUKQVBYgoISFJKgyAiKbnnIlfVt%2BYgrm0fetPvTXisHOmvv00OdtUVC9tML8swktj%2F%2F%2BAHb4rwSxKIR1XiDNUVYYyJshrxRb3r1IPC9sNGow8oS0l4BtQ525Yg8d%2BNXpHJErn76EyJ6AqtOwOQcaP4CaDFo%2BC7o1iBouthNHnPR0YmWvCotuC6RZteQ7Tj76oI8P7Fx83oIwU5vffbR%2Bu%2BL%2FF0wUyI1Jd6X3xG01cPBHV2Qgzu6sOTpeprJjtyl45e9m9FMXP3yTbFTaMNXl23%2Fi1fZWBjD43vCZrdpwmXStuTxkuRcmBVtmCBfr9pNEW3kdmspN0me3t54bWW1kxphrdTJEFSevXMfTI7I%2F%2B%2B%2FN7nZF51jSDOEyUt08lMyLUg9BEv3YNOZe6sJjJrNRKmDIi8Hxo9mP5UkUGLGaVTC%2FotHM7xvH6JtHNDsweRSu6ZEV5Wgqg%2BbXx1kqTm99WNtUoiUM4iUcQ4iZdTHl9FaeV4RYezGwvVFFLeiuEFd3oqDVkRbnmhEIfWQ2RH7%2BcnyPwAAAP%2F%2FAQAA%2F%2F9QU5SGiwQAAA%3D%3D | 192.243.61.225 | 200 OK | 7 B |
URL HTTP/1.1experimentalconcerningsuck.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSv28cRRueTfI1XyosKCgQV1CAFJ9393bvR1xEGGNkEWwrCViiQbMzs%2BfBczurmd3bs5XCIhJKg3RQAOX6OTsWxELJH4BAZxpkGh8IcIHpaSiQqNGdTzp4i32fZ5%2B3eN5n3g%2F38wviIqfnG2%2FpXakUXQirbuXlTZlwXdjK2r2K51bdxcqmTOrBYqU3%2FpjuTc8Nq%2B4rlTcE29YLvuu5rud6lRVpRKx7CxMVMj1uedWWWw38qhcG6Jn%2Fcps7sNQB716QOUg%2B%2Bt%2FW908h2RBJ58mysNuZTm%2B83skVzbRBlx%2B9nWwnukjQmcHYOIiTo%2Bk0tB0R8vkV6ORougF092C8ASI5Is4vHqLkaGoTUffw0mmkIBJE%2FDqK7hBCDSHpEEw%2FgORnBGAca%2BtIOo%2FWtCnozqVKx%2BqIXPv7L8hiRK799iySzldLSvYqd7XKM6kTi15cQvaGkO0h0vwE2a4DWZyAZR9AcoKkU0Ly85cC2vJj1ojnRVRvzge0Hs63fFqfb%2Fj1yHNb1Pf8YBKNlEPIeAgl%2BqD2CnLrIJcO8thBnjro8PMKDVux6zbiKK7VmgFjrFZjLGzWechrQTN2kbOx9z6ytA%2Bm%2BmBmD6nZw7b85CycO1v4Bib%2FFnarhOUObEbQ5SUKQVBYgoISFJKgyAiKbnnIlfVt%2BYgrm0fetPvTXisHOmvv00OdtUVC9tML8swktj%2F%2F%2BAHb4rwSxKIR1XiDNUVYYyJshrxRb3r1IPC9sNGow8oS0l4BtQ525Yg8d%2BNXpHJErn76EyJ6AqtOwOQcaP4CaDFo%2BC7o1iBouthNHnPR0YmWvCotuC6RZteQ7Tj76oI8P7Fx83oIwU5vffbR%2Bu%2BL%2FF0wUyI1Jd6X3xG01cPBHV2Qgzu6sOTpeprJjtyl45e9m9FMXP3yTbFTaMNXl23%2Fi1fZWBjD43vCZrdpwmXStuTxkuRcmBVtmCBfr9pNEW3kdmspN0me3t54bWW1kxphrdTJEFSevXMfTI7I%2F%2B%2B%2FN7nZF51jSDOEyUt08lMyLUg9BEv3YNOZe6sJjJrNRKmDIi8Hxo9mP5UkUGLGaVTC%2FotHM7xvH6JtHNDsweRSu6ZEV5Wgqg%2BbXx1kqTm99WNtUoiUM4iUcQ4iZdTHl9FaeV4RYezGwvVFFLeiuEFd3oqDVkRbnmhEIfWQ2RH7%2BcnyPwAAAP%2F%2FAQAA%2F%2F9QU5SGiwQAAA%3D%3D IP192.243.61.225:0 ASN#39572 DataWeb Global Group B.V.
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSv28cRRueTfI1XyosKCgQV1CAFJ9393bvR1xEGGNkEWwrCViiQbMzs%2BfBczurmd3bs5XCIhJKg3RQAOX6OTsWxELJH4BAZxpkGh8IcIHpaSiQqNGdTzp4i32fZ5%2B3eN5n3g%2F38wviIqfnG2%2FpXakUXQirbuXlTZlwXdjK2r2K51bdxcqmTOrBYqU3%2FpjuTc8Nq%2B4rlTcE29YLvuu5rud6lRVpRKx7CxMVMj1uedWWWw38qhcG6Jn%2Fcps7sNQB716QOUg%2B%2Bt%2FW908h2RBJ58mysNuZTm%2B83skVzbRBlx%2B9nWwnukjQmcHYOIiTo%2Bk0tB0R8vkV6ORougF092C8ASI5Is4vHqLkaGoTUffw0mmkIBJE%2FDqK7hBCDSHpEEw%2FgORnBGAca%2BtIOo%2FWtCnozqVKx%2BqIXPv7L8hiRK799iySzldLSvYqd7XKM6kTi15cQvaGkO0h0vwE2a4DWZyAZR9AcoKkU0Ly85cC2vJj1ojnRVRvzge0Hs63fFqfb%2Fj1yHNb1Pf8YBKNlEPIeAgl%2BqD2CnLrIJcO8thBnjro8PMKDVux6zbiKK7VmgFjrFZjLGzWechrQTN2kbOx9z6ytA%2Bm%2BmBmD6nZw7b85CycO1v4Bib%2FFnarhOUObEbQ5SUKQVBYgoISFJKgyAiKbnnIlfVt%2BYgrm0fetPvTXisHOmvv00OdtUVC9tML8swktj%2F%2F%2BAHb4rwSxKIR1XiDNUVYYyJshrxRb3r1IPC9sNGow8oS0l4BtQ525Yg8d%2BNXpHJErn76EyJ6AqtOwOQcaP4CaDFo%2BC7o1iBouthNHnPR0YmWvCotuC6RZteQ7Tj76oI8P7Fx83oIwU5vffbR%2Bu%2BL%2FF0wUyI1Jd6X3xG01cPBHV2Qgzu6sOTpeprJjtyl45e9m9FMXP3yTbFTaMNXl23%2Fi1fZWBjD43vCZrdpwmXStuTxkuRcmBVtmCBfr9pNEW3kdmspN0me3t54bWW1kxphrdTJEFSevXMfTI7I%2F%2B%2B%2FN7nZF51jSDOEyUt08lMyLUg9BEv3YNOZe6sJjJrNRKmDIi8Hxo9mP5UkUGLGaVTC%2FotHM7xvH6JtHNDsweRSu6ZEV5Wgqg%2BbXx1kqTm99WNtUoiUM4iUcQ4iZdTHl9FaeV4RYezGwvVFFLeiuEFd3oqDVkRbnmhEIfWQ2RH7%2BcnyPwAAAP%2F%2FAQAA%2F%2F9QU5SGiwQAAA%3D%3D HTTP/1.1
Host: experimentalconcerningsuck.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Cookie: u_pl=15723212; uid_id2=4a92fc7f-eb68-4a65-92a6-726b109a2124:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:33 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 795972780211c843ced8d740337faa8a
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| nudgeworry.com/pixel/purst?dl=0&th=0&sc=0&rs=2822&rd=2822&fd=613&bv=22.10.v.10&tmpl=136 | 192.243.59.12 | 200 OK | 0 B |
URL HTTP/1.1nudgeworry.com/pixel/purst?dl=0&th=0&sc=0&rs=2822&rd=2822&fd=613&bv=22.10.v.10&tmpl=136 IP192.243.59.12:0 ASN#39572 DataWeb Global Group B.V.
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /pixel/purst?dl=0&th=0&sc=0&rs=2822&rd=2822&fd=613&bv=22.10.v.10&tmpl=136 HTTP/1.1
Host: nudgeworry.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Cookie: u_pl=15725408; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNTcyNTQwOCwiayI6ImMxNmUyOGFkOTEyZDc3YjE0YjdhZGExOTFkZTE3OWNkIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMzg3NzM2LCJwaWQiOjIzNTIyMCwiYW4iOnRydWUsImxhbiI6dHJ1ZSwiY2lkIjoxOCwiYWlkIjoyNywicHQiOjQsInBrIjoiZzRpYXgwcGF1IiwiY3BrcyI6eyAiMjgiOiI1YzM1NzJlYzNhMjgwMmM3ZmFkNDcyY2QyYWUyMTUzYiIsIjI5IjoiODgxMTBjYjkzMjk0ZmQ4MjRjMDZkYzhjZTNjNzkxMDQifSwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjkwNzUzNDU3LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6MTIwNjI1LCJibiI6IkZpcmVmb3giLCJidiI6IjEwNS4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vd3d3LmRlbW9ub2lkLmlzL2ZpbGVzL2RldGFpbHMvNjEzNTk5LzA1NDUxNzcyNy8ifX0.iJrhLxIqt3vQ4YAOG7shmFHSQJAFEcaws_b6mAZIW3g
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Sun, 29 Jan 2023 17:43:33 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| cdn.cloudimagesb.com/bi/f2/a5/2c/f2a52ccfafb5d887e44bd24083c29318/1630692162.jpg | 45.133.44.10 | 200 OK | 41 kB |
URL HTTP/2cdn.cloudimagesb.com/bi/f2/a5/2c/f2a52ccfafb5d887e44bd24083c29318/1630692162.jpg IP45.133.44.10:0 ASN#39572 DataWeb Global Group B.V.
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 22x30, components 3\012- data Hash7040b274ed0d091b0440593afd7bfd58 ae22eaca344fa2ef20e50e9207108309f3561706 1e504470e7eb87afb7cf1c924d4ae725e4f3d06d764f9cabf8cd7c0827343866
GET /bi/f2/a5/2c/f2a52ccfafb5d887e44bd24083c29318/1630692162.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:33 GMT
content-type: image/jpeg
content-length: 39563
server: nginx/1.17.6
last-modified: Fri, 03 Sep 2021 18:02:52 GMT
etag: "6132634c-9a8b"
expires: Tue, 31 Jan 2023 17:43:33 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| e1.o.lencr.org/ | 23.36.76.226 | 200 OK | 496 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
File typeGIF image data, version 89a, 1 x 30\012- data Hash6e546a7603ce7cd507449b8a908ba36a 54fb399ac717c66315fa4bee324d70af87f90f19 f43d511a1ec57bc863d4da80fa3cce7edb344c8823ae21ecf107c9f4e39a408f
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "A3D92B83C5E18E8B559D0830A26EF62410A5922A213A1508EBB9F177EBDB8F51"
Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9050
Expires: Sun, 29 Jan 2023 20:14:23 GMT
Date: Sun, 29 Jan 2023 17:43:33 GMT
Connection: keep-alive
|
|
| e1.o.lencr.org/ | 23.36.76.226 | 200 OK | 344 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash92150eb32d9db49422cf29f24536530f ee14343bc6797e6e4004aa93002e20e82ede365f a3d92b83c5e18e8b559d0830a26ef62410a5922a213a1508ebb9f177ebdb8f51
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "A3D92B83C5E18E8B559D0830A26EF62410A5922A213A1508EBB9F177EBDB8F51"
Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9050
Expires: Sun, 29 Jan 2023 20:14:23 GMT
Date: Sun, 29 Jan 2023 17:43:33 GMT
Connection: keep-alive
|
|
| e1.o.lencr.org/ | 23.36.76.226 | 200 OK | 344 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash92150eb32d9db49422cf29f24536530f ee14343bc6797e6e4004aa93002e20e82ede365f a3d92b83c5e18e8b559d0830a26ef62410a5922a213a1508ebb9f177ebdb8f51
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "A3D92B83C5E18E8B559D0830A26EF62410A5922A213A1508EBB9F177EBDB8F51"
Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9050
Expires: Sun, 29 Jan 2023 20:14:23 GMT
Date: Sun, 29 Jan 2023 17:43:33 GMT
Connection: keep-alive
|
|
| cdn.cloudimagesb.com/si/89/9f/8a/899f8a5bb7132795d339610f52f16dad/1667589937.png | 45.133.44.10 | 200 OK | 33 kB |
URL HTTP/2cdn.cloudimagesb.com/si/89/9f/8a/899f8a5bb7132795d339610f52f16dad/1667589937.png IP45.133.44.10:0 ASN#39572 DataWeb Global Group B.V.
File typePNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced\012- data Hash2cb2500acb00f247ef19403c3a0f89e1 7c57e8b84b2bb0003810ffae7a14e24869155464 7efcd5082673b787603d2a0b8d768fb26807cf2ab79771a69886a916d0cda3ce
GET /si/89/9f/8a/899f8a5bb7132795d339610f52f16dad/1667589937.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:33 GMT
content-type: image/png
content-length: 32763
server: nginx/1.17.6
last-modified: Fri, 04 Nov 2022 19:25:45 GMT
etag: "63656739-7ffb"
expires: Tue, 31 Jan 2023 17:43:33 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 16 kB |
IP142.250.74.131:0
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2020:05:28 21:53:03], progressive, precision 8, 237x66, components 3\012- data Hashc8c895955c06844c5d0ef637f33dd34c 464b461fa2b9f6bc04e5a991589f9b1c6654af8c 2e784bd1cd31691e6c9c100461cd0e382e207d7e400b789de15ddd80db1e0334
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 17:43:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| cdn.creative-bars1.com/sb/ssp/in-page_push/os/android/2/img/close.png | 172.64.167.9 | 200 OK | 2.0 kB |
URL HTTP/2cdn.creative-bars1.com/sb/ssp/in-page_push/os/android/2/img/close.png IP172.64.167.9:0
File typePNG image data, 19 x 19, 8-bit/color RGBA, non-interlaced\012- data Hash2cecae5111d5ff932a996679215ad573 f4c63abb5dc373aba5bc144c3831d98516cc7cc9 31f6aad6a88eca32f245dc6d0e030ef422f306b4f8479855b30e59b6dc134ebc
GET /sb/ssp/in-page_push/os/android/2/img/close.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:33 GMT
content-type: image/png
content-length: 2005
last-modified: Wed, 11 May 2022 09:01:03 GMT
etag: "627b7b4f-7d5"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 6493919
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BDgSezZjMiOeVctRf0wtqQgdqM0DNERpUe3mCkUF6Ks7oo9cEfXxR%2BVomIbvuVoXsvWh5nOlUpMQGSmEHi6%2ByH3G8DyMTVtLe4Cj0XCYl4rD8B4fMSCisdVauad6QvTeCvKi2crJgVQr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7913c551af3f76d8-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 471 B |
IP142.250.74.131:0
Hash8c630e9bbc930d1c367efa81b67be3f7 ec536695531d40a813d99a06271c7c2d698d51d3 39ca0a60c3e2e85712757ead0830d0da82beac1e4f44b6e90243e5ca9326bf4b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 17:43:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| e1.o.lencr.org/ | 23.36.76.226 | 200 OK | 344 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash92150eb32d9db49422cf29f24536530f ee14343bc6797e6e4004aa93002e20e82ede365f a3d92b83c5e18e8b559d0830a26ef62410a5922a213a1508ebb9f177ebdb8f51
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 344
ETag: "A3D92B83C5E18E8B559D0830A26EF62410A5922A213A1508EBB9F177EBDB8F51"
Last-Modified: Sun, 29 Jan 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9050
Expires: Sun, 29 Jan 2023 20:14:23 GMT
Date: Sun, 29 Jan 2023 17:43:33 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hashba712b809d1107138674cd304e041068 cb7ed5692720084e2b66e724712685d1d56dbe94 1624708856cbcf339b6acc2d31268b693af742aa1b0c699391dddbb09c493347
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1624708856CBCF339B6ACC2D31268B693AF742AA1B0C699391DDDBB09C493347"
Last-Modified: Sat, 28 Jan 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=1915
Expires: Sun, 29 Jan 2023 18:15:28 GMT
Date: Sun, 29 Jan 2023 17:43:33 GMT
Connection: keep-alive
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 471 B |
IP142.250.74.131:0
Hash8cf65fcdafa84b63cf7005fe57927fcb 3f7d163a96e7f00eb2de9828624ec46e22b4b40a dfcf629cc49444f646f3a014014a91e36251b4b43655ce2e2eca55263dd196e3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 17:43:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 471 B |
IP142.250.74.131:0
Hash8cf65fcdafa84b63cf7005fe57927fcb 3f7d163a96e7f00eb2de9828624ec46e22b4b40a dfcf629cc49444f646f3a014014a91e36251b4b43655ce2e2eca55263dd196e3
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 17:43:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL HTTP/2fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 IP216.58.207.227:0
File typeWeb Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data Hash15d9f621c3bd1599f0169dcf0bd5e63e 7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52 f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.demonoid.is
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 25 Jan 2023 19:33:54 GMT
expires: Thu, 25 Jan 2024 19:33:54 GMT
cache-control: public, max-age=31536000
age: 338979
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL HTTP/2fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 IP216.58.207.227:0
File typeWeb Open Font Format (Version 2), TrueType, length 15740, version 1.0\012- data Hashb9c29351c46f3e8c8631c4002457f48a e57e59c5780995ff2937ab2b511a769212974a87 f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
GET /s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.demonoid.is
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15740
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 28 Jan 2023 10:26:49 GMT
expires: Sun, 28 Jan 2024 10:26:49 GMT
cache-control: public, max-age=31536000
age: 112604
last-modified: Wed, 11 May 2022 19:24:56 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 471 B |
IP142.250.74.131:0
Hashdb3290a85d0ba4da27406ae9636aa618 4c69da45eddd66a1e26fce5562fc45eda7005309 19db4d0cc84bff9586883a5fa69c426af0b5fc1c2760ee7c259b0307c8afa6b2
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 29 Jan 2023 17:43:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| experimentalconcerningsuck.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSMW8jRRidTULDVURQUCBcUIB0cXbXu177UpwIISjiSKK7g0g0aHZm1hmy3lnN7Hqd6IqIk9A1SIYCKDfPyUVwEbr7AQjk0KDQxCAgBaGnoUCiRnYsmfuK%2Fd7b9xXve%2FN9fJBfEhs5vdh8R%2B3JOKaLftWuvLolE64KU1m%2FW3Hsqr1U2ZJJ3VuqdEcf3bnh2H7Vfq3ylmA7atG1Hdt2bKeyKrWIVHdxrEKmJ02n2rSrnlt1fA9d%2FTQ3uQVDLfDOJZmH5MNntn98AskGSNqPV4TZyVR6%2Fc12HtNMaXT48bvJTqKKBO0pjLSFKDmeTEOZISFfzkAlx5MNoDqHow0QyiGxfnMQJscTmwg7R1dOwxgiQcivoegMIOIBJB2AqfuQ%2FJwAjGN9A0n74brSBd29UulIHZK5f%2F%2BBLIZk7o%2FnkbS%2FWY5lt3JHxXkmVWLQjUrI7gCyNUCanyLbsyCLU7DsI0hOkLRLSH7xikebbsSCaEGE9caCR%2Bv%2BQtOl9YXArYeO3aSu43rjaKQcQEYDxKIHamaQGwu5tJBHFvLUQptfVKjfjGw7iMKoVmt4jLFajTG%2FUec%2Br3mNyEbORt57yNIeWNwD0%2FtI9T525Gfn%2Fvz54nfQ%2Bfcw2yUMt2Aygg4vUQiCwhAUlKCQBEVGUHTKIx4b15QPeWzy0Jl0d9JrZV9lrQN6pLKWSMhBekmeG8f2918%2FYUdcVLxIBGGNB6wh%2FBoTfsPnQb3h1D3PdfwgqMPIEtLMgBoLe3JIXrj%2BO1I5JLOf%2F4KQnsLEp2ByHjR%2FCbToB64Nut33Gjb2kkdctFWiJK9KA65KpNkcsl3rIL4kL45t3LjmQ7Czm198svHnEn8fTJdIdYkP5Q8ErfhB%2F7YqyOFtVRjyZCPNZFvu0dHL3sloJma%2FflvsFkrztRXT%2B%2Bp1NhJG8OSuMNktmnCZtAx5tCw5F3pVaSbIt2tmS4SbudleznWSp7c231hda6daGCNVMgCV5%2B%2FdA5ND8uy9D8Y3%2B7J1AqkH0HmJdn5GJgWpBmDpPkw6dW8UgY6nM2FqocjLvnbD6c9YEsRiymlYwvyPh1N8YB6gpS3Q7P74Uju6RCcuQeMeTD7bz1J9dvPn2rgQxlY%2FjLV1GMY6%2FvQqWiMvKr7jiUbYCBjnoWDcCdxao2bbLude0BROE5kZsl8fr%2FwHAAD%2F%2FwEAAP%2F%2FRFsaYIsEAAA%3D | 192.243.61.225 | 200 OK | 7 B |
URL HTTP/1.1experimentalconcerningsuck.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSMW8jRRidTULDVURQUCBcUIB0cXbXu177UpwIISjiSKK7g0g0aHZm1hmy3lnN7Hqd6IqIk9A1SIYCKDfPyUVwEbr7AQjk0KDQxCAgBaGnoUCiRnYsmfuK%2Fd7b9xXve%2FN9fJBfEhs5vdh8R%2B3JOKaLftWuvLolE64KU1m%2FW3Hsqr1U2ZJJ3VuqdEcf3bnh2H7Vfq3ylmA7atG1Hdt2bKeyKrWIVHdxrEKmJ02n2rSrnlt1fA9d%2FTQ3uQVDLfDOJZmH5MNntn98AskGSNqPV4TZyVR6%2Fc12HtNMaXT48bvJTqKKBO0pjLSFKDmeTEOZISFfzkAlx5MNoDqHow0QyiGxfnMQJscTmwg7R1dOwxgiQcivoegMIOIBJB2AqfuQ%2FJwAjGN9A0n74brSBd29UulIHZK5f%2F%2BBLIZk7o%2FnkbS%2FWY5lt3JHxXkmVWLQjUrI7gCyNUCanyLbsyCLU7DsI0hOkLRLSH7xikebbsSCaEGE9caCR%2Bv%2BQtOl9YXArYeO3aSu43rjaKQcQEYDxKIHamaQGwu5tJBHFvLUQptfVKjfjGw7iMKoVmt4jLFajTG%2FUec%2Br3mNyEbORt57yNIeWNwD0%2FtI9T525Gfn%2Fvz54nfQ%2Bfcw2yUMt2Aygg4vUQiCwhAUlKCQBEVGUHTKIx4b15QPeWzy0Jl0d9JrZV9lrQN6pLKWSMhBekmeG8f2918%2FYUdcVLxIBGGNB6wh%2FBoTfsPnQb3h1D3PdfwgqMPIEtLMgBoLe3JIXrj%2BO1I5JLOf%2F4KQnsLEp2ByHjR%2FCbToB64Nut33Gjb2kkdctFWiJK9KA65KpNkcsl3rIL4kL45t3LjmQ7Czm198svHnEn8fTJdIdYkP5Q8ErfhB%2F7YqyOFtVRjyZCPNZFvu0dHL3sloJma%2FflvsFkrztRXT%2B%2Bp1NhJG8OSuMNktmnCZtAx5tCw5F3pVaSbIt2tmS4SbudleznWSp7c231hda6daGCNVMgCV5%2B%2FdA5ND8uy9D8Y3%2B7J1AqkH0HmJdn5GJgWpBmDpPkw6dW8UgY6nM2FqocjLvnbD6c9YEsRiymlYwvyPh1N8YB6gpS3Q7P74Uju6RCcuQeMeTD7bz1J9dvPn2rgQxlY%2FjLV1GMY6%2FvQqWiMvKr7jiUbYCBjnoWDcCdxao2bbLude0BROE5kZsl8fr%2FwHAAD%2F%2FwEAAP%2F%2FRFsaYIsEAAA%3D IP192.243.61.225:0 ASN#39572 DataWeb Global Group B.V.
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSMW8jRRidTULDVURQUCBcUIB0cXbXu177UpwIISjiSKK7g0g0aHZm1hmy3lnN7Hqd6IqIk9A1SIYCKDfPyUVwEbr7AQjk0KDQxCAgBaGnoUCiRnYsmfuK%2Fd7b9xXve%2FN9fJBfEhs5vdh8R%2B3JOKaLftWuvLolE64KU1m%2FW3Hsqr1U2ZJJ3VuqdEcf3bnh2H7Vfq3ylmA7atG1Hdt2bKeyKrWIVHdxrEKmJ02n2rSrnlt1fA9d%2FTQ3uQVDLfDOJZmH5MNntn98AskGSNqPV4TZyVR6%2Fc12HtNMaXT48bvJTqKKBO0pjLSFKDmeTEOZISFfzkAlx5MNoDqHow0QyiGxfnMQJscTmwg7R1dOwxgiQcivoegMIOIBJB2AqfuQ%2FJwAjGN9A0n74brSBd29UulIHZK5f%2F%2BBLIZk7o%2FnkbS%2FWY5lt3JHxXkmVWLQjUrI7gCyNUCanyLbsyCLU7DsI0hOkLRLSH7xikebbsSCaEGE9caCR%2Bv%2BQtOl9YXArYeO3aSu43rjaKQcQEYDxKIHamaQGwu5tJBHFvLUQptfVKjfjGw7iMKoVmt4jLFajTG%2FUec%2Br3mNyEbORt57yNIeWNwD0%2FtI9T525Gfn%2Fvz54nfQ%2Bfcw2yUMt2Aygg4vUQiCwhAUlKCQBEVGUHTKIx4b15QPeWzy0Jl0d9JrZV9lrQN6pLKWSMhBekmeG8f2918%2FYUdcVLxIBGGNB6wh%2FBoTfsPnQb3h1D3PdfwgqMPIEtLMgBoLe3JIXrj%2BO1I5JLOf%2F4KQnsLEp2ByHjR%2FCbToB64Nut33Gjb2kkdctFWiJK9KA65KpNkcsl3rIL4kL45t3LjmQ7Czm198svHnEn8fTJdIdYkP5Q8ErfhB%2F7YqyOFtVRjyZCPNZFvu0dHL3sloJma%2FflvsFkrztRXT%2B%2Bp1NhJG8OSuMNktmnCZtAx5tCw5F3pVaSbIt2tmS4SbudleznWSp7c231hda6daGCNVMgCV5%2B%2FdA5ND8uy9D8Y3%2B7J1AqkH0HmJdn5GJgWpBmDpPkw6dW8UgY6nM2FqocjLvnbD6c9YEsRiymlYwvyPh1N8YB6gpS3Q7P74Uju6RCcuQeMeTD7bz1J9dvPn2rgQxlY%2FjLV1GMY6%2FvQqWiMvKr7jiUbYCBjnoWDcCdxao2bbLude0BROE5kZsl8fr%2FwHAAD%2F%2FwEAAP%2F%2FRFsaYIsEAAA%3D HTTP/1.1
Host: experimentalconcerningsuck.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Cookie: u_pl=15723212; uid_id2=4a92fc7f-eb68-4a65-92a6-726b109a2124:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:33 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: f026c278c0ce69007089b0a1e2ded2e0
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| unseenreport.com/pxf.gif?uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5&eb=afa55bd8bbaeee6cbf2f0b21fb513961&te=9e4947f35751465411fd1a4f5c358c78&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.1055&b_frame=0&pk=5c3572ec3a2802c7fad472cd2ae2153b&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=17 | 192.243.59.12 | 200 OK | 1 B |
URL HTTP/1.1unseenreport.com/pxf.gif?uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5&eb=afa55bd8bbaeee6cbf2f0b21fb513961&te=9e4947f35751465411fd1a4f5c358c78&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.1055&b_frame=0&pk=5c3572ec3a2802c7fad472cd2ae2153b&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=17 IP192.243.59.12:0 ASN#39572 DataWeb Global Group B.V.
File typevery short file (no magic) Hash93b885adfe0da089cdf634904fd59f71 5ba93c9db0cff93f52b521d7420e43f6eda2784f 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /pxf.gif?uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5&eb=afa55bd8bbaeee6cbf2f0b21fb513961&te=9e4947f35751465411fd1a4f5c358c78&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.1055&b_frame=0&pk=5c3572ec3a2802c7fad472cd2ae2153b&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=17 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Sun, 29 Jan 2023 17:43:33 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 95025f3309adcb31061415daa8130164
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| unseenreport.com/pxf.gif?uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5&eb=afa55bd8bbaeee6cbf2f0b21fb513961&te=9e4947f35751465411fd1a4f5c358c78&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.1055&b_frame=0&pk=4fe7b3d7c8e53ce585d7681644215776&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=17 | 192.243.59.12 | 200 OK | 1 B |
URL HTTP/1.1unseenreport.com/pxf.gif?uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5&eb=afa55bd8bbaeee6cbf2f0b21fb513961&te=9e4947f35751465411fd1a4f5c358c78&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.1055&b_frame=0&pk=4fe7b3d7c8e53ce585d7681644215776&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=17 IP192.243.59.12:0 ASN#39572 DataWeb Global Group B.V.
File typevery short file (no magic) Hash93b885adfe0da089cdf634904fd59f71 5ba93c9db0cff93f52b521d7420e43f6eda2784f 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /pxf.gif?uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5&eb=afa55bd8bbaeee6cbf2f0b21fb513961&te=9e4947f35751465411fd1a4f5c358c78&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.1055&b_frame=0&pk=4fe7b3d7c8e53ce585d7681644215776&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=17 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Sun, 29 Jan 2023 17:43:33 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 099aa364ad1591664d39c1f51007873d
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| unseenreport.com/pxf.gif?uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5&eb=afa55bd8bbaeee6cbf2f0b21fb513961&te=9e4947f35751465411fd1a4f5c358c78&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.1055&b_frame=0&pk=10751f56c065681448ce50ea9554fbfc&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=17 | 192.243.59.12 | 200 OK | 1 B |
URL HTTP/1.1unseenreport.com/pxf.gif?uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5&eb=afa55bd8bbaeee6cbf2f0b21fb513961&te=9e4947f35751465411fd1a4f5c358c78&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.1055&b_frame=0&pk=10751f56c065681448ce50ea9554fbfc&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=17 IP192.243.59.12:0 ASN#39572 DataWeb Global Group B.V.
File typevery short file (no magic) Hash93b885adfe0da089cdf634904fd59f71 5ba93c9db0cff93f52b521d7420e43f6eda2784f 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /pxf.gif?uuid=2687ace9-ea2a-4154-b089-2c38a5942fe5&eb=afa55bd8bbaeee6cbf2f0b21fb513961&te=9e4947f35751465411fd1a4f5c358c78&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A105.0)%20Gecko%2F20100101%20Firefox%2F105.0&dev=e&res=14.1055&b_frame=0&pk=10751f56c065681448ce50ea9554fbfc&bl=en-US&sr=1002x1280&sz=1024x1280&hjs=17 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.17.6
Date: Sun, 29 Jan 2023 17:43:33 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 359e15c57de71f573c0585275d76d3f5
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| experimentalconcerningsuck.com/pixel/sbs?c=1 | 192.243.61.225 | 200 OK | 0 B |
URL HTTP/1.1experimentalconcerningsuck.com/pixel/sbs?c=1 IP192.243.61.225:0 ASN#39572 DataWeb Global Group B.V.
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /pixel/sbs?c=1 HTTP/1.1
Host: experimentalconcerningsuck.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://www.demonoid.is/
Cookie: u_pl=15723212; uid_id2=4a92fc7f-eb68-4a65-92a6-726b109a2124:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sun, 29 Jan 2023 17:43:33 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62d5a25c-3219-4061-b58b-b783bc3a37fb.jpeg | 34.120.237.76 | 200 OK | 7.4 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62d5a25c-3219-4061-b58b-b783bc3a37fb.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash6af6f32397882f56d14d22348e44a9f1 5a626376807e7507fa3a204c4e4e9e44aa074a37 478f32e98c0a1f0d62fa337795ca88b7927e14b684b681f7629b648bc2d709a5
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62d5a25c-3219-4061-b58b-b783bc3a37fb.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 7417
x-amzn-requestid: 53032353-8613-49b0-944d-3742236cf50c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fYcMmFeQIAMF3Yw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d340b6-7fe2226327d90db014527c08;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 03:10:46 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: zd8cTO2N1JO-OK3hCDwVO8naClCsg0raJLboRFle-DPSKhR_7k8-Yg==
via: 1.1 6ba2a21321beeef65404429d0a4b6380.cloudfront.net (CloudFront), 1.1 981753271eb5b6d11bc29d52f173a5da.cloudfront.net (CloudFront), 1.1 google
date: Sun, 29 Jan 2023 03:16:35 GMT
age: 52024
etag: "5a626376807e7507fa3a204c4e4e9e44aa074a37"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| www.demonoid.is/files/details/613599/054517727/ | 172.67.185.32 | 200 OK | 0 B |
URL HTTP/2www.demonoid.is/files/details/613599/054517727/ IP172.67.185.32:0
GET /files/details/613599/054517727/ HTTP/1.1
Host: www.demonoid.is
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:30 GMT
content-type: text/html; charset=UTF-8
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: frame-ancestors 'self';
onion-location: http://demonoidevmsgasmojajlhikwetsr4pxzw6xkjt3dgdv6nr5yxvsamid.onion/files/details/613599/054517727/
allow: GET, POST
varnish-status: HIT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BxRnAG%2BaUXJn47DC9LohMRR2wVBcb4XgevHTgJOTR02jToHgVLo9Mt1TjjKenrHIgwhPcQHHHBhuEfgTiVDh2mBUs9BAIAddiSnAuriSS63hsHNTlTobqa%2BQXTaA0i%2Fk8hI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 7913c540095fb4fa-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdn.barscreative1.com/sb/au/e1/6f/bb/e16fbbe9f31c82c23d1d57f9726b5fc7/1654616215.html | 45.133.44.3 | 200 OK | 0 B |
URL HTTP/2cdn.barscreative1.com/sb/au/e1/6f/bb/e16fbbe9f31c82c23d1d57f9726b5fc7/1654616215.html IP45.133.44.3:0 ASN#39572 DataWeb Global Group B.V.
| Analyzer | Verdict | Alert |
|---|
| fortinet | Phishing | |
GET /sb/au/e1/6f/bb/e16fbbe9f31c82c23d1d57f9726b5fc7/1654616215.html HTTP/1.1
Host: cdn.barscreative1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.demonoid.is
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:33 GMT
content-type: text/html; charset=utf-8
server: nginx/1.17.6
last-modified: Tue, 07 Jun 2022 15:37:00 GMT
etag: W/"629f709c-40e"
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: Date
content-encoding: gzip
expires: Sun, 29 Jan 2023 18:43:33 GMT
x-proxy-cache: HIT
X-Firefox-Spdy: h2
|
|
| fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap | 142.250.74.74 | 200 OK | 0 B |
URL HTTP/2fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap IP142.250.74.74:0
GET /css?family=Roboto:300,400,700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sun, 29 Jan 2023 17:43:33 GMT
date: Sun, 29 Jan 2023 17:43:33 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| cdn.creative-bars1.com/sb/ssp/in-page_push/os/android/2/css/animate.css | 172.64.167.9 | 200 OK | 0 B |
URL HTTP/2cdn.creative-bars1.com/sb/ssp/in-page_push/os/android/2/css/animate.css IP172.64.167.9:0
GET /sb/ssp/in-page_push/os/android/2/css/animate.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.demonoid.is
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:33 GMT
content-type: text/css
last-modified: Wed, 11 May 2022 09:01:02 GMT
etag: W/"627b7b4e-1358d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WCFmCJrBfYmbf%2BV15s1c%2BBem2QfXC1FlXsZ%2F86%2BbNqu953wFyxVKr016etiBJQlhcEw6PIYCmASFvHEsNf0MJVx%2BT%2BDJ%2BScCpC15aJg2CUiPxzRta1Eu2IPmeH1gCSBknnU5%2BF6xQLeR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7913c5513cd3407e-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdn.creative-bars1.com/sb/ssp/in-page_push/os/android/2/js/script.js | 172.64.167.9 | 200 OK | 0 B |
URL HTTP/2cdn.creative-bars1.com/sb/ssp/in-page_push/os/android/2/js/script.js IP172.64.167.9:0
GET /sb/ssp/in-page_push/os/android/2/js/script.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.demonoid.is
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:33 GMT
content-type: application/javascript
last-modified: Wed, 11 May 2022 09:01:04 GMT
etag: W/"627b7b50-194"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0zN%2Fl6XPYV6Ef5fPl5AaxTBkqPx%2Fwul%2FrG51VqXr946SIZ5cKhm%2FuDOrUmpsiOWjhLD42F5dgRwakbPzVk4a0kRhmw5a2AHdXInsshHvneBleG3aBQjZb3UMoutI2aSJ%2BEipzK9ilZwc"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7913c5514ce8407e-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdn.creative-bars1.com/sb/ssp/in-page_push/os/android/2/css/style.css | 172.64.167.9 | 200 OK | 0 B |
URL HTTP/2cdn.creative-bars1.com/sb/ssp/in-page_push/os/android/2/css/style.css IP172.64.167.9:0
GET /sb/ssp/in-page_push/os/android/2/css/style.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://www.demonoid.is
Connection: keep-alive
Referer: https://www.demonoid.is/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 29 Jan 2023 17:43:33 GMT
content-type: text/css
last-modified: Wed, 11 May 2022 09:01:01 GMT
etag: W/"627b7b4d-126c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2UOBIwaVuPVoP7VvG%2Fk0DQHXnrSgwLWX6GLuooN5uF4LA9bYos5ayRZfaNmEjBt0Sq1kTGxtbcfio8Y5fGlnG9g7CUpLtz2Z1eo63pEAgQVXmU%2FDAN6nx3yuytQRKyY5HvcRqcdgc%2FsA"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7913c5516d04407e-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
0.0.0.0