Report - ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271

Report Overview

Visited public
2023-11-23 17:14:19
Tags
URL
ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Finishing URL
ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271#
IP / ASN
188.114.96.1
#13335 CLOUDFLARENET
Title
Walmart

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
my.rtmark.net	9054	2014-10-29	2015-02-04 10:54:57	2023-11-23 05:11:21	1.5 kB	1.9 kB	139.45.195.8
pentlyconger.com	unknown	2021-08-12	2021-08-13 10:08:22	2023-11-20 00:09:58	919 B	4.0 kB	18.192.249.87
redrotou.net	145989	2021-03-12	2021-03-16 06:03:50	2023-11-21 16:36:57	986 B	28 kB	139.45.197.251
stormtrk.com	289095	2019-05-15	2019-05-17 20:09:53	2023-11-20 00:09:58	916 B	1.4 kB	104.26.4.120
cdn.stfilecamp.com	400667	2021-09-06	2021-09-06 17:32:03	2023-11-22 04:13:28	401 B	33 kB	104.18.12.192
cdn-adef.akamaized.net	125719	2014-03-18	2018-02-06 08:56:01	2023-11-23 09:31:09	435 B	4.6 kB	23.36.76.194
ziaont.com	unknown	2023-02-13	2023-02-13 07:35:21	2023-11-18 17:22:34	13 kB	439 kB	188.114.96.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed
2023-11-23	medium	ziaont.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (12)

	URL	From	Size	First Seen	Last Seen
	ziaont.com/z/index_files/second_back.js	ScriptElement	2.2 kB	2023-03-07	2025-05-09
Pretty URL ziaont.com/z/index_files/second_back.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:40 Last Seen2025-05-09 18:17 Times Seen437 Hash 8dcc9f5ed8ffe107323085e2952946e3 60a762e6c3f93a4176dba2a336ef4d8c8c8aa9ea aa30848f0b1633b7fbb5d7a3cf3b75a9f897fc310b3bfca1bbe89d98f2a06328 Loading...

	ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271	ScriptElement	496 B	2023-08-18	2024-08-21
Pretty URL ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271 IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-08-18 05:42 Last Seen2024-08-21 08:28 Times Seen50 Hash 0e776c4bb6876cab5eb208559031f96b a8211d0554b83df54549f201bc80235ceae48a72 a27b1c6ef0f71411dc8bc4c63bc43c2340b67dabdd34930c161279a29653609d Loading...

	my.rtmark.net/p.js?f=sync&lr=1&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990	ScriptElement	697 B	2023-03-26	2024-08-21
Pretty URL my.rtmark.net/p.js?f=sync&lr=1&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990 IP 139.45.195.8 ASN #9002 RETN Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-26 14:20 Last Seen2024-08-21 09:30 Times Seen194 Hash 4c31f3c3993d15451b1cbf592344e69d 202eaf67a1b877dbaa3fdf17edd6b520aa9254e0 76f40efce542cf27486eb36faf5787e5769246644ed03c8c6bc446a21e7ad18e Loading...

	ziaont.com/z/index_files/jquery.min.js	ScriptElement	88 kB	2023-03-07	2025-05-11
Pretty URL ziaont.com/z/index_files/jquery.min.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-11 14:32 Times Seen68233 Hash 220afd743d9e9643852e31a135a9f3ae 88523924351bac0b5d560fe0c5781e2556e7693d 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Loading...

	ziaont.com/z/index_files/stormtrk.js	ScriptElement	6.5 kB	2023-03-07	2025-05-09
Pretty URL ziaont.com/z/index_files/stormtrk.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03 Last Seen2025-05-09 18:17 Times Seen437 Hash 469e121bb4c4fe159bbca2b4f5a88267 f0c66f226de28b324e4f1ecb766597938f984c60 4706b6d6c3e39cf2915a772595f2cc124e96d0919538b56aa817113e6482c416 Loading...

	ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271	ScriptElement	83 B	2023-04-07	2024-08-21
Pretty URL ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271 IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-07 17:20 Last Seen2024-08-21 09:30 Times Seen194 Hash cc8b574af920ace3d58d9114f4e6ab6c bae263945e9961d815f4c5bbef052c29dcc51dcf c85f159ca98233d658799d0a88c5fccea12e11424b144d598b7ae3e81971ce55 Loading...

	ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271	ScriptElement	1.6 kB	2023-03-07	2024-10-11
Pretty URL ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271 IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:40 Last Seen2024-10-11 08:32 Times Seen839 Hash 88f1478c977eac6c59d28d1c7ddd80df 647aefa687a36f49bb7d25375da25718445dd31f 14c9a3ed05798d5a423b51ccb9b1e568a62e4b268e721a41c129de8b5df51ccd Loading...

	ziaont.com/z/index_files/main.js	ScriptElement	3.1 kB	2023-03-07	2025-05-09
Pretty URL ziaont.com/z/index_files/main.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:40 Last Seen2025-05-09 18:17 Times Seen860 Hash 03d61bebb9362e3571c134d17e88261e c966e468ebbc5ac203bb35ea7b3a5cc586768b37 d25d6be4101c96b081881ae7f929b86cfc535abfadfdd3f62ebd71c17f76afdd Loading...

	ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271	ScriptElement	489 B	2023-04-07	2024-08-21
Pretty URL ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271 IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-07 17:20 Last Seen2024-08-21 09:36 Times Seen330 Hash d20e8d57e86019fbf43e12ef1ea13624 7a9dbef6dbf25aa57bcc90fb40fc889536860282 323b9833a7256fef9f7acc60b22f3248013057e3f94e66efbda0530de3637592 Loading...

	pentlyconger.com/d/.js?lpref=&lpurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3DRQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg%26lptoken%3D170100f5766c14d52271%23&lpt=Walmart&vtm=1700759646022	ScriptElement	3.7 kB	2023-11-23	2023-11-23
Pretty URL pentlyconger.com/d/.js?lpref=&lpurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3DRQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg%26lptoken%3D170100f5766c14d52271%23&lpt=Walmart&vtm=1700759646022 IP 18.192.249.87 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-23 18:14 Last Seen2023-11-23 18:14 Times Seen1 Hash 000cccd850a8904a40b10181fdad083a e3f0abf3aaf641bd6f2ab20412ad40fe5e83b06c 38da802e9c94edc23e35f63bb9f7f96f5f1e78bdfbbdfc351b2c677c8e79b5de Loading...

	redrotou.net/pfe/current/micro.tag.min.js?z=6206858&sw=/sw-check-permissions-f1d69.js	ScriptElement	27 kB	2023-11-02	2024-08-20
Pretty URL redrotou.net/pfe/current/micro.tag.min.js?z=6206858&sw=/sw-check-permissions-f1d69.js IP 139.45.197.251 ASN #9002 RETN Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-02 09:44 Last Seen2024-08-20 21:23 Times Seen8998 Hash 5ccd2d5882a06f293d07510ac91c92e6 b44dc0eaa03981adb70d3313e728f9359c1d21c1 9fc2aa21f3a7bfe66783d35fdbb48147f73e72a41f87aea848f64a8cb4518eba Loading...

	cdn.stfilecamp.com/fp.min.js	ScriptElement	32 kB	2023-04-06	2025-05-09
Pretty URL cdn.stfilecamp.com/fp.min.js IP 104.18.12.192 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-06 21:01 Last Seen2025-05-09 18:17 Times Seen568 Hash 198f2f5b0a649f41fe890c59d37319aa f24629687612889bb59f610df3879afcd766fb80 d2bc2cb800679f495a7731c105b2e2047965800515f98008867ab33edc940912 Loading...

HTTP Transactions (25)

URL IP Response Size

ziaont.com/z/index_files/11.png

188.114.96.1

200 OK

20 kB

URL GET HTTP/3
ziaont.com/z/index_files/11.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
PNG image data, 531 x 531, 8-bit/color RGBA, non-interlaced\012- data
Size
20 kB (19608 bytes)
Hash
1c7e1037a62b15dc080894acb7955aa7
4400836d965f60e0dc7f093ce50b2c869f0f5ab7
c379ce20c3e8081a24ee7f71d94ad73d88d2d2db94c99b1d33effd4d6849f31a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/11.png HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:02 GMT
content-type: image/png
content-length: 19608
last-modified: Wed, 02 Nov 2022 07:26:35 GMT
etag: "63621bab-4c98"
expires: Fri, 08 Dec 2023 04:07:04 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1343218
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wyF3rF8rxe9EL63L5tI46avSgBXy74CBPwALiputBUrxPPFFDxU62G8UcbBEErEAJ90KS6MrRe%2BzpoG%2B1hV0Joeu8CLYKgCRMV3%2FuoOqFhG3nxZqo6fP1KQXwdUB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ab0bd838f57129-OSL
alt-svc: h3=":443"; ma=86400

ziaont.com/z/index_files/prizewheel-amazon_2.png?1

188.114.96.1

200 OK

104 kB

URL GET HTTP/3
ziaont.com/z/index_files/prizewheel-amazon_2.png?1
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
PNG image data, 502 x 502, 8-bit/color RGBA, non-interlaced\012- data
Size
104 kB (104023 bytes)
Hash
fa45d2b35f605ccfb363df33d6054844
9b0ad37d32a3f44231b91b64eafe2b7729fefda7
b1a5ac0fdc54446907a81b4f9736919a78b6c667ebd191e4aff8b19d54790f97

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/prizewheel-amazon_2.png?1 HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:02 GMT
content-type: image/png
content-length: 104023
last-modified: Thu, 18 May 2023 09:46:44 GMT
etag: "6465f404-19657"
expires: Fri, 08 Dec 2023 04:07:04 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1343218
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JxsBCx6NzNiP5AG71bv8JqG5E8bC%2BpIsmiJqAueNp%2Fi%2FwNYKp28snbSGTBrEiE%2F%2BP75ue02zztizs%2FUmq6ScZqzJenah3zVxhW1%2FuBiWhROBrcin7HCz7%2Ba39HYD"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ab0bd838f77129-OSL
alt-svc: h3=":443"; ma=86400

ziaont.com/z/index_files/spin-button.png

188.114.96.1

200 OK

5.6 kB

URL GET HTTP/3
ziaont.com/z/index_files/spin-button.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
PNG image data, 276 x 301, 8-bit colormap, non-interlaced\012- data
Size
5.6 kB (5586 bytes)
Hash
66271b99acf174bf87d903ffac88c5f5
69e67eb0440ff320c8603071207b43a95e90c2bb
a2f084594e048fe1bf77c215f4c9447bb355584eb749dc8a5841a0c250ca9172

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/spin-button.png HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:02 GMT
content-type: image/png
content-length: 5586
last-modified: Wed, 02 Nov 2022 07:26:46 GMT
etag: "63621bb6-15d2"
expires: Fri, 22 Dec 2023 03:13:27 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 136835
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JAAzN6JtMlXOSVGm7it0G44pF4ZZ8Ry5Q2rTwGgab2CrcTEvoxMkFZnZvNhYY12I8h%2FMIiU%2FykUbGquIg3TVUbX3pTdLA4iAwrTkdmNbO%2Bvcj3sk%2Bdo3AGDsdH4q"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ab0bd838f87129-OSL
alt-svc: h3=":443"; ma=86400

ziaont.com/z/index_files/walmart_1.png?1

188.114.96.1

200 OK

160 kB

URL GET HTTP/3
ziaont.com/z/index_files/walmart_1.png?1
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
PNG image data, 533 x 363, 8-bit/color RGBA, non-interlaced\012- data
Size
160 kB (160485 bytes)
Hash
3b52cfca4d8020080c18b651bbaf9c13
2d374c4010ecb38aa47ccf30ee03107155d4e647
6fce4e32f529207683d525dfff676242b72003ca36ff2cfbcaa90de895b8f4be

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/walmart_1.png?1 HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:02 GMT
content-type: image/png
content-length: 160485
last-modified: Thu, 18 May 2023 09:46:45 GMT
etag: "6465f405-272e5"
expires: Fri, 22 Dec 2023 18:43:48 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 81014
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B9STYWpQ2Dl%2F7JBlU2%2Fw6Pk4D1MQMfguBwLi7GGC29MjstJDgW9HIIADzzWnmdbjl8ZohsLcA3W34k%2BMwtyCElB7Sfaj65kB6YwaRsls%2FLBeYbX93VZPannByc5u"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ab0bd838fb7129-OSL
alt-svc: h3=":443"; ma=86400

my.rtmark.net/p.js?f=sync&lr=1&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990

139.45.195.8

200 OK

697 B

URL GET HTTP/2
my.rtmark.net/p.js?f=sync&lr=1&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990
IP
139.45.195.8:443
ASN
#9002 RETN Limited

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerLet's Encrypt
Subjectrtmark.net
FingerprintE8:81:4E:79:89:89:BE:CE:75:1F:E0:2A:60:54:8A:A4:11:2E:F7:42
ValiditySat, 07 Oct 2023 15:22:00 GMT - Fri, 05 Jan 2024 15:21:59 GMT

File type
ASCII text
Size
697 B (697 bytes)
Hash
4c31f3c3993d15451b1cbf592344e69d
202eaf67a1b877dbaa3fdf17edd6b520aa9254e0
76f40efce542cf27486eb36faf5787e5769246644ed03c8c6bc446a21e7ad18e

HTTP Headers

GET /p.js?f=sync&lr=1&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: text/javascript
content-length: 697
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

ziaont.com/z/index_files/stormtrk.js

188.114.96.1

200 OK

5.8 kB

URL GET HTTP/3
ziaont.com/z/index_files/stormtrk.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
ASCII text
Size
5.8 kB (5781 bytes)
Hash
469e121bb4c4fe159bbca2b4f5a88267
f0c66f226de28b324e4f1ecb766597938f984c60
4706b6d6c3e39cf2915a772595f2cc124e96d0919538b56aa817113e6482c416

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/stormtrk.js HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: application/javascript
last-modified: Wed, 02 Nov 2022 07:26:47 GMT
vary: Accept-Encoding
etag: W/"63621bb7-1966"
expires: Fri, 24 Nov 2023 05:14:03 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wTDBJQzh17xe6uqbcLnHDq1gMuo0Rd69be%2Bh9996w0QPgTaXn%2B6WkA9oCLcpf4EOreob%2FOKBr1EWuQRAoC%2FS8C%2FONv%2FB1WefCjQEW4pjfvM%2Bjm8%2BcCjowGlxbnio"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82ab0bd838ef7129-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

ziaont.com/z/index_files/second_back.js

188.114.96.1

200 OK

861 B

URL GET HTTP/3
ziaont.com/z/index_files/second_back.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
ASCII text
Size
861 B (861 bytes)
Hash
8dcc9f5ed8ffe107323085e2952946e3
60a762e6c3f93a4176dba2a336ef4d8c8c8aa9ea
aa30848f0b1633b7fbb5d7a3cf3b75a9f897fc310b3bfca1bbe89d98f2a06328

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/second_back.js HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: application/javascript
last-modified: Wed, 02 Nov 2022 07:26:45 GMT
vary: Accept-Encoding
etag: W/"63621bb5-8b7"
expires: Fri, 24 Nov 2023 05:14:03 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gwL9njHhzn5a81QU5pA6WFwtHomJLZvg2k29Yb539Ja0TbhZn72QhT0hzWELsAS3pjpVRHI%2Fuld7McbGkcpAKSDidSAzqp7y9y9sZkHrgJdBAsX7ahoEsW%2BKy1qH"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82ab0bd828e27129-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

ziaont.com/z/index_files/2.jpg

188.114.96.1

200 OK

3.7 kB

URL GET HTTP/3
ziaont.com/z/index_files/2.jpg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, datetime=2017:06:15 10:57:43], baseline, precision 8, 50x50, components 3\012- data
Size
3.7 kB (3694 bytes)
Hash
02eebe83bc6786ef27b852477d4c4998
205314ba911137b6f6be4eefd946a2c62229e591
a0038f9d5f6fe1ce8fe1bf1cc7256f05e16c11d27041739c55918b823744753c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/2.jpg HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/index_files/style.css?2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: image/jpeg
content-length: 3694
last-modified: Wed, 02 Nov 2022 07:26:36 GMT
etag: "63621bac-e6e"
expires: Fri, 08 Dec 2023 15:01:44 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1303939
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SjkGoXfFXzrhC5OORdpxaQctfI%2Bx5JQVlwlK%2FnnrhdBZLEVDoeAUb%2FReA7RSe%2BBQ7B7pZla0w9XpdP0GmGxyn4SqQy7u6L6ppjpWE1MFwhooSw0h5aPrOrELCSRn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ab0bdb5dda7129-OSL
alt-svc: h3=":443"; ma=86400

ziaont.com/z/index_files/3.jpg

188.114.96.1

200 OK

1.1 kB

URL GET HTTP/3
ziaont.com/z/index_files/3.jpg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 50x50, components 3\012- data
Size
1.1 kB (1063 bytes)
Hash
72ab252d8ff828965ad984b8ab16991f
e45ea3665e80feb2e6309b04e1ec2e8d41bb279b
c5d70c3abf95aecc84bcc1b1f9fc25848e690852071169bf57522fd671550291

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/3.jpg HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/index_files/style.css?2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: image/jpeg
content-length: 1063
last-modified: Wed, 02 Nov 2022 07:26:37 GMT
etag: "63621bad-427"
expires: Mon, 27 Nov 2023 10:50:48 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 2269395
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kvODrP8iaKo76%2BEYLLVOqHXur7AvrqmQFvzuofT38ab4uFqi4qKOb56efM2%2FthqhENzrMhw99%2FdgeKJUke%2B1KpgP%2BKnhTP6hs%2BwdfkSztkj8DDIBKMSWb5NlbSmO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ab0bdb5de47129-OSL
alt-svc: h3=":443"; ma=86400

ziaont.com/z/index_files/5.jpg

188.114.96.1

200 OK

3.3 kB

URL GET HTTP/3
ziaont.com/z/index_files/5.jpg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, datetime=2017:06:15 10:57:43], baseline, precision 8, 50x50, components 3\012- data
Size
3.3 kB (3268 bytes)
Hash
92c40a962aa579868b64b8b7f1b6575c
f676f1ce463a7b0b7b2c05587a9b52285e55e679
64e47fb0b1dc439d03463c15a7977d88988a4d3f7d563e3d772cc9ca8d41e414

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/5.jpg HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/index_files/style.css?2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: image/jpeg
content-length: 3268
last-modified: Wed, 02 Nov 2022 07:26:39 GMT
etag: "63621baf-cc4"
expires: Fri, 22 Dec 2023 18:43:48 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 81015
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5%2BaRvEbqDZl%2BaCB9PtswwfrtUS%2B9%2BFkT0b6Q1jG3%2FIr1o5pIWC%2FCSdzsSUytudPw64GqprEdIvOPm91siWGXH8XK23EFjQw1nbwFwAjnHkfXo25OYHJHE7Ne4W%2Ba"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ab0bdb6dee7129-OSL
alt-svc: h3=":443"; ma=86400

pentlyconger.com/d/.js?lpref=&lpurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3DRQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg%26lptoken%3D170100f5766c14d52271%23&lpt=Walmart&vtm=1700759646022

18.192.249.87

200 OK

3.7 kB

URL GET HTTP/2
pentlyconger.com/d/.js?lpref=&lpurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3DRQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg%26lptoken%3D170100f5766c14d52271%23&lpt=Walmart&vtm=1700759646022
IP
18.192.249.87:443
ASN
#16509 AMAZON-02

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerLet's Encrypt
Subjectpentlyconger.com
Fingerprint08:30:41:92:4E:E7:EE:E4:74:42:FF:FB:50:89:83:6C:E2:B5:AF:BB
ValidityTue, 26 Sep 2023 06:49:01 GMT - Mon, 25 Dec 2023 06:49:00 GMT

File type
ASCII text, with very long lines (1682)
Size
3.7 kB (3710 bytes)
Hash
000cccd850a8904a40b10181fdad083a
e3f0abf3aaf641bd6f2ab20412ad40fe5e83b06c
38da802e9c94edc23e35f63bb9f7f96f5f1e78bdfbbdfc351b2c677c8e79b5de

HTTP Headers

GET /d/.js?lpref=&lpurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3DRQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg%26lptoken%3D170100f5766c14d52271%23&lpt=Walmart&vtm=1700759646022 HTTP/1.1
Host: pentlyconger.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: application/javascript;charset=UTF-8
content-length: 3710
access-control-allow-origin: *
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
X-Firefox-Spdy: h2

ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271

188.114.96.1

200 OK

4.7 kB

URL User Request GET HTTP/2
ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (514)
Size
4.7 kB (4684 bytes)
Hash
5f5cfa9aac77613046d196838f719b85
a680998012dbe466059684ab3289f95d20f20d45
42191d523f05b31e0dd88d7126915be5d9bd1bca127047473264c3bc064b8318

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271 HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 23 Nov 2023 17:14:02 GMT
content-type: text/html
last-modified: Mon, 14 Aug 2023 05:52:13 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FiZNM6SzlqOyf2WOl00u4S28Vh9xjAabU28%2FlVHLRwUmxC9YjCNcHbZuVz5AY8DGAXncCgWBMdXpItzCBNJAFqUm9UVkTZffM5BLxuga3SSi9NbNAOT3XzIcfHtf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82ab0bd44c035691-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

redrotou.net/zone?&pub=0&zone_id=6206858&is_mobile=false&domain=ziaont.com&var=&ymid=&var_3=&var_4=&dsig=&tg=1&sw=3.1.471&action=prerequest

139.45.197.251

200 OK

0 B

URL POST HTTP/2
redrotou.net/zone?&pub=0&zone_id=6206858&is_mobile=false&domain=ziaont.com&var=&ymid=&var_3=&var_4=&dsig=&tg=1&sw=3.1.471&action=prerequest
IP
139.45.197.251:443
ASN
#9002 RETN Limited

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerLet's Encrypt
Subjectredrotou.net
Fingerprint75:61:49:6F:3C:DF:A2:36:1C:08:81:85:8A:A6:7D:E9:AE:31:71:1D
ValiditySat, 28 Oct 2023 05:44:53 GMT - Fri, 26 Jan 2024 05:44:52 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /zone?&pub=0&zone_id=6206858&is_mobile=false&domain=ziaont.com&var=&ymid=&var_3=&var_4=&dsig=&tg=1&sw=3.1.471&action=prerequest HTTP/1.1
Host: redrotou.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ziaont.com
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers

HTTP/2 200 OK
server: nginx
date: Thu, 23 Nov 2023 17:14:03 GMT
content-length: 0
x-trace-id: b18aff61ae6a623b4a2fa3b729d731e5
access-control-allow-origin: https://ziaont.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2

my.rtmark.net/img.gif?f=sync&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990&ttl=&rurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3DRQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg%26lptoken%3D170100f5766c14d52271%23

139.45.195.8

200 OK

43 B

URL GET HTTP/2
my.rtmark.net/img.gif?f=sync&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990&ttl=&rurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3DRQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg%26lptoken%3D170100f5766c14d52271%23
IP
139.45.195.8:443
ASN
#9002 RETN Limited

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerLet's Encrypt
Subjectrtmark.net
FingerprintE8:81:4E:79:89:89:BE:CE:75:1F:E0:2A:60:54:8A:A4:11:2E:F7:42
ValiditySat, 07 Oct 2023 15:22:00 GMT - Fri, 05 Jan 2024 15:21:59 GMT

File type
GIF image data, version 89a, 1 x 1\012- data
Size
43 B (43 bytes)
Hash
b4491705564909da7f9eaf749dbbfbb1
279315d507855c6a4351e1e2c2f39dd9cd2fccd8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

HTTP Headers

GET /img.gif?f=sync&partner=f82bb87b192f1720f3978127fce2dd46efd05fd461c0c45aa6d2fb32ef60a990&ttl=&rurl=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3DRQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg%26lptoken%3D170100f5766c14d52271%23 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: image/gif
content-length: 43
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=4a5499bbc43f47bc8b9054386d1bda6f; expires=Fri, 22 Nov 2024 17:14:03 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

ziaont.com/z/index_files/style.css?2

188.114.96.1

200 OK

21 kB

URL GET HTTP/3
ziaont.com/z/index_files/style.css?2
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
ASCII text
Size
21 kB (20628 bytes)
Hash
cffc01d3f82e5e03e1bddc9a1405fba6
a92cd1941ba14c0c692aaa73c354bb4625833a37
9d3df57abc060dd08f728b371ecdf0269234e282bf04dfacd921be6e48da7dd2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/style.css?2 HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: text/css
last-modified: Wed, 02 Nov 2022 07:26:49 GMT
vary: Accept-Encoding
etag: W/"63621bb9-96b1"
expires: Fri, 24 Nov 2023 05:14:03 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CnVsp1O99it2QnmjMfnDnf8qNAt0hp89gnPbKS2QEiMziQKaqEIeV7sf59vs7igFwe8QSwrr0BLD3adZ3MqiOKTjgoxTWvjqXRk8brDLxNFC0EXOx%2F7BT1xI6L8S"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82ab0bd818b97129-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

ziaont.com/z/index_files/jquery.min.js

188.114.96.1

200 OK

88 kB

URL GET HTTP/3
ziaont.com/z/index_files/jquery.min.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
ASCII text, with very long lines (65451)
Size
88 kB (88145 bytes)
Hash
220afd743d9e9643852e31a135a9f3ae
88523924351bac0b5d560fe0c5781e2556e7693d
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/jquery.min.js HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: application/javascript
last-modified: Wed, 02 Nov 2022 07:26:40 GMT
vary: Accept-Encoding
etag: W/"63621bb0-15851"
expires: Fri, 24 Nov 2023 05:14:03 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m0YLE1ocaZjOM9e9YAtr4mcuLpfgw8UIxXItP2sQh4yryAUHjrjnVWv9wOelKhloO7fFkmclcqeMwSNbmCcVlIip%2FbxDJ5CY7tKgFRfEJJAL%2BvLtoz3qGCNqdOJe"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82ab0bd828dd7129-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

ziaont.com/z/index_files/1.jpg

188.114.96.1

200 OK

3.9 kB

URL GET HTTP/3
ziaont.com/z/index_files/1.jpg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, datetime=2017:06:15 10:57:43], baseline, precision 8, 50x52, components 3\012- data
Size
3.9 kB (3900 bytes)
Hash
72c067fe856886245e7c47c7ff84e041
5210cb05f897db334c61f8971ccec9a7396ea8a7
9a106ad9f340c7bafdd365ea1ad24b9336c304b1e72653eb58e84b5604471030

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/1.jpg HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/index_files/style.css?2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: image/jpeg
content-length: 3900
last-modified: Wed, 02 Nov 2022 07:26:33 GMT
etag: "63621ba9-f3c"
expires: Fri, 22 Dec 2023 18:43:48 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 81015
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=br4gwHLScVlCLYp9IrTb438O6dG4kVRG6WKs0AL3Ri5BL009QjFZl3UUhXj03GF8sDboRPZm5hLt44A50uoSXzWZDw34zqAK%2BCdDZ8lDzTCdnobQry5Rm54v%2F11R"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ab0bdb5dd47129-OSL
alt-svc: h3=":443"; ma=86400

ziaont.com/sw-check-permissions-f1d69.js

188.114.96.1

200 OK

566 B

URL GET HTTP/3
ziaont.com/sw-check-permissions-f1d69.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
ASCII text, with very long lines (605), with no line terminators
Size
566 B (566 bytes)
Hash
035fe7d7c59399a5e710c8d151d0a9ec
929833ad44211c2f7cc8032b279d7668fe36af91
4f9934de580fa64a0d0fd66fe02690cd85e4ed3872d64d5ffb28cf2e724fb7c7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /sw-check-permissions-f1d69.js HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Cookie: vl-cep=cep=clj7BV2G6w5GBJQalpn4HhprMotQY-nLVa5aHa51L-UF07bLwrO6a6G8o0zGTHS3H0Znhw-m7giYqBR1CjsQtx668_Os_EnzfZMMC4eh3UK1OAqc8A6TXUpRbqRA6XA8LV5bT0sGggHfAod9HdxwFa09P7mfJWjd2fNizpIpvkU_yxyoSl_OagQ12aQMiRXzCHTJATAOCIDrCED5HMz30pQOyub3axqOHTTMgoIoUjSTOPvqkPdKYYJs7Zd5VRyufSMHST9ejE4CxqJsfQ_qgbFv7QQmw4eL3M7xgyJGu6Kny1akn3TKfcS5Tqb-Cz8D2kvQqzY-PVBsXyVAF8WRdZ4y2m0IyrLtbNNfRtVhLn0pZ3C0g23sre8NDaNXl0iHPcGUiGEFo62VniJgtwTQ9g
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:04 GMT
content-type: application/javascript
last-modified: Thu, 10 Aug 2023 03:36:41 GMT
etag: W/"64d45b49-236"
expires: Fri, 24 Nov 2023 05:14:04 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lZU1c3DRMy7yssXNJuKi0oejnQOndCPZKfAhUMXJXMza4b7YIO6GCGZb1sBkgzdOrArVkOcpjR8D0Sf%2BmfKcSsRyWSJJjB7QsyBlAldkuc0BleOiUoAHiKiNXDhH"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ab0bde3b5b7129-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

stormtrk.com/api/1.0/ping/pong?location=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3DRQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg%26lptoken%3D170100f5766c14d52271

104.26.4.120

200 OK

675 B

URL GET HTTP/2
stormtrk.com/api/1.0/ping/pong?location=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3DRQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg%26lptoken%3D170100f5766c14d52271
IP
104.26.4.120:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectstormtrk.com
Fingerprint1F:F3:7F:EE:CA:64:B3:D7:E5:63:51:58:3C:32:70:22:53:56:0E:76
ValidityWed, 08 Nov 2023 23:28:06 GMT - Tue, 06 Feb 2024 23:28:05 GMT

File type
troff or preprocessor input, ASCII text, with very long lines (696), with no line terminators
Size
675 B (675 bytes)
Hash
4715904bcfb035a9e8007682dfb587bd
6e6e01f53f0adcb3a70b476e994f6d5963174c96
f812f721660a449af65a13e2076f50759ec02bd6f0463071cd12ef800ab161ff

HTTP Headers

GET /api/1.0/ping/pong?location=https%3A%2F%2Fziaont.com%2Fz%2F%3Fcep%3DRQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg%26lptoken%3D170100f5766c14d52271 HTTP/1.1
Host: stormtrk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ziaont.com
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: application/json
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Content-Type, Access-Control-Allow-Headers, X-Requested-With
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mwD0Ee%2BVBffg9vmq7Yn14zRADfeT2J9TWaXLl8GFtC6nPElkdsL3KCCYHsD8kprxuFtocsPrwkiWTwcbDVyJY9p%2BxiP1Go%2BJSJfRVlnWc7JP78qbPim%2BJTJoZDC1Aw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82ab0bdb4def7130-OSL
content-encoding: br
X-Firefox-Spdy: h2

ziaont.com/z/index_files/like.png

188.114.96.1

200 OK

220 B

URL GET HTTP/3
ziaont.com/z/index_files/like.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
PNG image data, 13 x 12, 8-bit colormap, non-interlaced\012- data
Size
220 B (220 bytes)
Hash
e4c6e8dcd575bd5f346565ce8dbacfe7
29e5d4862f0470607f803d462bddf5f14cf57969
9e79a749ac5f41341fdff11f64845580207490915f72b09ec320e0db0fea224a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/like.png HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/index_files/style.css?2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: image/png
content-length: 220
last-modified: Wed, 02 Nov 2022 07:26:41 GMT
etag: "63621bb1-dc"
expires: Sat, 25 Nov 2023 02:27:57 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 2472366
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CxHlQcI043CJJv2%2BZ2Ccswtr2bs79mMeAm6EKfJLos7%2F%2B5a5zyHC%2FtQMnCuKpFai3mc87EnyL37x%2B%2FQc%2Bz5k6%2B9teQKNQplgOv%2BiypsEap7wIh6tEooRGLS8JWIE"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ab0bdb5dd07129-OSL
alt-svc: h3=":443"; ma=86400

ziaont.com/z/index_files/4.jpg

188.114.96.1

200 OK

1.0 kB

URL GET HTTP/3
ziaont.com/z/index_files/4.jpg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 50x50, components 3\012- data
Size
1.0 kB (1042 bytes)
Hash
e489d022a40ba80f51fb5acc1addea46
41c334f49c248783037ceaf6fc335acff62f760c
c39b4bfbcc6aa147547ca922c4f80350b48dbfa59cbd5176f44373e3b20f3567

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/4.jpg HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/index_files/style.css?2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: image/jpeg
content-length: 1042
last-modified: Wed, 02 Nov 2022 07:26:38 GMT
etag: "63621bae-412"
expires: Sat, 23 Dec 2023 17:14:03 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=755wnWa7q04A8r6tkFX%2Fglz30er5P4aJEo1sKyWMT1UWdukKznlqXHRW3xUMl2urmmLYIcahz4dIT%2F7Tv6LPbWEMT3J9n7qVBd4ek7zre%2BFkxnQLCebQOUsCS0Vm"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ab0bdb6deb7129-OSL
alt-svc: h3=":443"; ma=86400

cdn.stfilecamp.com/fp.min.js

104.18.12.192

200 OK

32 kB

URL GET HTTP/2
cdn.stfilecamp.com/fp.min.js
IP
104.18.12.192:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerLet's Encrypt
Subjectstfilecamp.com
FingerprintB9:69:70:B1:52:5D:FE:AE:F0:24:90:58:7D:85:5B:38:3E:38:9C:4F
ValidityThu, 26 Oct 2023 11:10:00 GMT - Wed, 24 Jan 2024 11:09:59 GMT

File type

Size
32 kB (31705 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /fp.min.js HTTP/1.1
Host: cdn.stfilecamp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 23 Nov 2023 17:14:04 GMT
content-type: text/javascript
last-modified: Mon, 13 Jun 2022 11:23:14 GMT
x-rgw-object-type: Normal
etag: W/"198f2f5b0a649f41fe890c59d37319aa"
x-amz-request-id: tx000003f9d7ee37b75dccf-006557cf3f-3c6f487a-sfo3a
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: 243e22a9-bb9f-4609-9c16-1fb0681c9c84
cache-control: max-age=3600
x-envoy-upstream-healthchecked-cluster: 
cf-cache-status: HIT
age: 260
set-cookie: __cf_bm=Alkt2VHgZn55oAhFwojXygVmo71bPF7R6LUG73BqeIs-1700759644-0-ATkKLTv6iSJm8wNRWGSeWM5ADQD9vx/GvbJ3vWA8wwy7O0awH1MyCv+H8ri1bpBBfq3pjIVC5wzM4kdoFwsJ5Tc=; path=/; expires=Thu, 23-Nov-23 17:44:04 GMT; domain=.cdn.stfilecamp.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 82ab0bdfef59b4f4-OSL
content-encoding: gzip
X-Firefox-Spdy: h2

redrotou.net/pfe/current/micro.tag.min.js?z=6206858&sw=/sw-check-permissions-f1d69.js

139.45.197.251

200 OK

27 kB

URL GET HTTP/2
redrotou.net/pfe/current/micro.tag.min.js?z=6206858&sw=/sw-check-permissions-f1d69.js
IP
139.45.197.251:443
ASN
#9002 RETN Limited

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerLet's Encrypt
Subjectredrotou.net
Fingerprint75:61:49:6F:3C:DF:A2:36:1C:08:81:85:8A:A6:7D:E9:AE:31:71:1D
ValiditySat, 28 Oct 2023 05:44:53 GMT - Fri, 26 Jan 2024 05:44:52 GMT

File type
ASCII text, with very long lines (27007), with no line terminators
Size
27 kB (27007 bytes)
Hash
5ccd2d5882a06f293d07510ac91c92e6
b44dc0eaa03981adb70d3313e728f9359c1d21c1
9fc2aa21f3a7bfe66783d35fdbb48147f73e72a41f87aea848f64a8cb4518eba

HTTP Headers

GET /pfe/current/micro.tag.min.js?z=6206858&sw=/sw-check-permissions-f1d69.js HTTP/1.1
Host: redrotou.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: application/javascript
last-modified: Wed, 22 Nov 2023 13:59:39 GMT
etag: W/"655e094b-697f"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2

cdn-adef.akamaized.net/images/favicon.ico

23.36.76.194

200 OK

4.1 kB

URL GET HTTP/1.1
cdn-adef.akamaized.net/images/favicon.ico
IP
23.36.76.194:443
ASN
#20940 Akamai International B.V.

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerDigiCert Inc
Subjecta248.e.akamai.net
FingerprintA3:C7:B4:95:4E:16:BD:C5:8A:EE:85:53:5D:C1:C2:CD:43:E9:EC:B9
ValidityTue, 16 May 2023 00:00:00 GMT - Wed, 15 May 2024 23:59:59 GMT

File type
PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced\012- data
Size
4.1 kB (4103 bytes)
Hash
4cdf3256cd7b8ec3917adb79d6bf457e
bc615337e9223183a126c8fb649774866fb53e69
fbfff44a653dc193b93620f1035d221d3aaddf3238742270b3385482986ef7f0

HTTP Headers

GET /images/favicon.ico HTTP/1.1
Host: cdn-adef.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: mzbDFFn0Yhqdz4XL9s4sX6yByljdNVrKhKiK+UtK4DVRgNzfBI6OtL7EakQiGwqEsC19uC++cQI=
x-amz-request-id: 78F19547EBC3B810
Last-Modified: Wed, 07 Nov 2018 08:41:38 GMT
ETag: "4cdf3256cd7b8ec3917adb79d6bf457e"
Accept-Ranges: bytes
Content-Type: image/x-icon
Content-Length: 4103
Server: AmazonS3
Date: Thu, 23 Nov 2023 17:14:04 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"

ziaont.com/z/index_files/main.js

188.114.96.1

200 OK

3.1 kB

URL GET HTTP/3
ziaont.com/z/index_files/main.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Certificate
IssuerGoogle Trust Services LLC
Subjectziaont.com
Fingerprint82:56:9A:CD:7E:19:BC:56:31:E4:58:11:C8:A9:A1:74:F6:73:4D:F2
ValiditySat, 07 Oct 2023 12:35:39 GMT - Fri, 05 Jan 2024 12:35:38 GMT

File type
ASCII text, with very long lines (3200), with no line terminators
Size
3.1 kB (3065 bytes)
Hash
fdd423b17da31208a5c21fad72b932b9
e91c7519cfec28bb1cbf7090140deb21551e811d
2bc415ece1375eaca76cd91cb34849987af8dddae11391d1972fabc4be0b0f6a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /z/index_files/main.js HTTP/1.1
Host: ziaont.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ziaont.com/z/?cep=RQ-o5AteBfUtnF_3tK350JWRPnNCNelV_oREk4Ht9oAkcq5n0ViBoeLUs8cZgwHqIxo7RquqsZ00mFipYEE8rYJqhpp6sUhKNjMvWvJJMhsSwepGRWhxrHsb2S4oL9c_i-bVraJuC1zjljMpNHwO9bdt_yj6BIOshH5aydIGHFVoodu4-etD01qoVtqR2IFKSl8ZZkmTQRXypDmJL1pGLVM08s0A9oBz4VNm4vGaoVQzRX6bQiG8DZ_lmdY52cvQoezm9-oLoBvbUdWSpqL1WRN1HQ6IVmHJ-qgqJhKkNXaXDlV7ZMdiisD4OfjLVLFW4x7zP1fUiSEBN5moIkDqQDRuXRFIie-B46_sH4zS7KtES5J-TJOgUw2HlAtdbDgfKc-A6-VoPntxa6lLTXXXAg&lptoken=170100f5766c14d52271
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 23 Nov 2023 17:14:03 GMT
content-type: application/javascript
last-modified: Wed, 02 Nov 2022 07:26:42 GMT
vary: Accept-Encoding
etag: W/"63621bb2-bf9"
expires: Fri, 24 Nov 2023 05:14:03 GMT
cache-control: max-age=43200
strict-transport-security: max-age=31536000
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BuAzgD0fYPPK5vEqWTUc28ZQmyXTLTxTYg%2BTldyl2r9JMswdvx0NoJs0lvftqy%2B2WrBJ3h7rD9vdNXKiJpPiwzR7lyFq0Xcdz0W7ufN90%2FSKH6YFqpoR2rHjlmf%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82ab0bd828e17129-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (12)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by