WEBSITE ANALYSIS REPORT

http://epawg.com/videos/689791/oreob4by-anal-play/

30 May 2026 · 12:25:04.000 UTCpublic

Report tags
Submit tags

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

657ed82b34.ce7609977e.com4 captured requests
a64842e9de.198b531aae.com1 captured requests
accounts.google.com3 captured requests
epawg.com16 captured requests
flushpersist.com1 captured requests
fonts.googleapis.com1 captured requests
fonts.gstatic.com1 captured requests
fp.metricswpsh.com2 captured requests
js.capndr.com1 captured requests
js.wpadmngr.com1 captured requests
js.wpushsdk.com2 captured requests
na.nawpush.com1 captured requests
nereserv.com1 captured requests
ntvpforever.com2 captured requests
p.a64x.com1 captured requests
picdn.vip2 captured requests
pl22022116.toprevenuegate.com1 captured requests
preferencenail.com1 captured requests
protrafficinspector.com2 captured requests
realizationnewestfangs.com1 captured requests
static.bookmsg.com2 captured requests

Connections

epawg.com → 657ed82b34.ce7609977e.comCalls2 captured connections
epawg.com → 657ed82b34.ce7609977e.comLoads from2 captured connections
epawg.com → a64842e9de.198b531aae.comCalls1 captured connections
epawg.com → accounts.google.comLoads from3 captured connections
epawg.com → flushpersist.comLoads from1 captured connections
epawg.com → fonts.googleapis.comLoads from1 captured connections
epawg.com → fonts.gstatic.comLoads from1 captured connections
epawg.com → fp.metricswpsh.comCalls2 captured connections
epawg.com → js.capndr.comLoads from1 captured connections
epawg.com → js.wpadmngr.comLoads from1 captured connections
epawg.com → js.wpushsdk.comLoads from2 captured connections
epawg.com → na.nawpush.comCalls1 captured connections
epawg.com → nereserv.comCalls1 captured connections
epawg.com → ntvpforever.comCalls2 captured connections
epawg.com → p.a64x.comLoads from1 captured connections
epawg.com → picdn.vipLoads from2 captured connections
epawg.com → pl22022116.toprevenuegate.comLoads from1 captured connections
epawg.com → preferencenail.comLoads from1 captured connections
epawg.com → protrafficinspector.comCalls2 captured connections
epawg.com → realizationnewestfangs.comLoads from1 captured connections
epawg.com → static.bookmsg.comLoads from2 captured connections
p.a64x.com → picdn.vipRedirects to1 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

12:24:41.395 GET 200 document 36.9 KB 218 ms —

12:24:41.735 GET 200 stylesheet 5.6 KB 254 ms —

12:24:41.738 GET 200 stylesheet 134.7 KB 43 ms —

12:24:41.740 GET 200 stylesheet 5.3 KB 89 ms —

12:24:41.743 GET 200 script 95.4 KB 743 ms 3 alerts

12:24:41.745 GET 200 script 132.8 KB 221 ms 1 alerts

12:24:41.746 GET 200 img 9.0 KB 35 ms —

12:24:41.748 GET 200 script 161.7 KB 75 ms —

12:24:41.750 GET 200 img 6.6 KB 51 ms —

12:24:41.751 GET 200 script 204.0 KB 97 ms —

12:24:41.972 GET 200 font 21.7 KB 193 ms —

12:24:42.265 GET 200 img 0 B 652 ms 1 alerts

12:24:42.269 GET 200 script 83.4 KB 176 ms 2 alerts

12:24:42.271 GET 200 xhr 40 B 296 ms —

12:24:42.324 GET 200 stylesheet 28.6 KB 44 ms —

12:24:42.346 GET 200 img 3.1 KB 43 ms —

12:24:42.423 GET 200 font 9.3 KB 51 ms —

12:24:42.486 GET 200 img 43 B 48 ms —

12:24:42.523 GET 200 xhr 1.4 KB 176 ms 1 alerts

12:24:42.530 GET 200 script 0 B 197 ms 1 alerts

12:24:42.734 GET 200 img 4.2 KB 33 ms —

12:24:42.771 GET 200 xhr 40 B 21 ms —

12:24:43.032 GET 200 font 2.2 KB 69 ms —

12:24:43.124 GET 200 img 59.0 KB 61 ms —

12:24:43.165 OPTIONS 204 xhr 0 B 251 ms —

12:24:43.182 GET 200 xhr 0 B 273 ms —

12:24:43.193 GET 200 script 253.6 KB 224 ms 1 alerts

12:24:43.197 OPTIONS 204 xhr 0 B 243 ms 1 alerts

12:24:43.198 GET 200 img 43 B 47 ms —

12:24:43.262 GET 200 img 0 B 696 ms 2 alerts

12:24:43.361 POST 200 xhr 57 B 33 ms —

12:24:43.488 POST 200 xhr 58 B 258 ms 1 alerts

Transaction #36

Request / response

URL

POST HTTPS

https://fp.metricswpsh.com/fp?tag_id=139033

IP / ASN

157.90.84.242

AS24940 · Hetzner Online GmbH

Requested by: https://epawg.com/videos/689791/oreob4by-anal-play/

Resource information

File type: JSON text data
MIME type: application/json; charset=UTF-8
First seen (UTC): 26 Jul 2025 · 17:44:43.174 UTC
Last seen (UTC): 07 Jun 2026 · 07:46:29.043 UTC
Times seen: 7033

Size: 58 B (58 bytes)
MD5: c4efc1d6d16235d9433cd2565d887460
SHA1: 22d069a5f536640e46122475c79db933e82d7f2e
SHA256: f0a6b8c736b7d8c5d3304a9ccd10d2114a0f25f2ba946cce62204df3384a131f

Certificate information

Issuer: Let's Encrypt · E7
Subject: notification.tubecup.net
Protocol / cipher: TLSv1.2 · TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
SHA1 fingerprint: 0C:AB:C2:4F:E8:EB:D1:F6:52:72:10:0B:DB:42:96:37:2B:43:97:8B
Valid from: Mon, 06 Apr 2026 11:01:41 GMT
Valid until: Sun, 05 Jul 2026 11:01:40 GMT

Technology fingerprints

Nginx:1.20.1 (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
Cloudflare DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

POST /fp?tag_id=139033 HTTP/1.1
Host: fp.metricswpsh.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json;charset=utf-8
Content-Length: 1973
Origin: https://epawg.com
DNT: 1
Connection: keep-alive
Referer: https://epawg.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Sat, 30 May 2026 12:24:43 GMT
Content-Type: application/json; charset=UTF-8
Content-Length: 58
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://epawg.com
Set-Cookie: id=9851083499215354593; Expires=Sun, 30 May 2027 12:24:43 GMT; Secure; SameSite=None
Vary: Origin

Request body

Captured 1.9 KB · Displayed 1.9 KB

{"timezoneOlson":"UTC","incognito":true,"fonts":{"value":["Bitstream Vera Sans Mono","Century"],"duration":233},"fontPreferences":{"value":{"default":173.11666870117188,"apple":173.11666870117188,"serif":173.11666870117188,"sans":162.01666259765625,"mono":122.68333435058594,"min":10.800003051757812,"system":162.01666259765625},"duration":106},"languages":{"value":[["en-US"],["en-US","en"]],"duration":0},"colorDepth":{"value":24,"duration":0},"deviceMemory":{"duration":0},"screenResolution":{"value":[1280,1024],"duration":0},"hardwareConcurrency":{"value":48,"duration":0},"timezone":{"value":"UTC","duration":27},"sessionStorage":{"value":true,"duration":0},"localStorage":{"value":true,"duration":0},"indexedDB":{"value":true,"duration":1},"platform":{"value":"Win32","duration":0},"plugins":{"value":[{"name":"PDF Viewer","description":"Portable Document Format","mimeTypes":[{"type":"application/pdf","suffixes":"pdf"},{"type":"text/pdf","suffixes":"pdf"}]},{"name":"Chrome PDF Viewer","description":"Portable Document Format","mimeTypes":[{"type":"application/pdf","suffixes":"pdf"},{"type":"text/pdf","suffixes":"pdf"}]},{"name":"Chromium PDF Viewer","description":"Portable Document Format","mimeTypes":[{"type":"application/pdf","suffixes":"pdf"},{"type":"text/pdf","suffixes":"pdf"}]},{"name":"Microsoft Edge PDF Viewer","description":"Portable Document Format","mimeTypes":[{"type":"application/pdf","suffixes":"pdf"},{"type":"text/pdf","suffixes":"pdf"}]},{"name":"WebKit built-in PDF","description":"Portable Document Format","mimeTypes":[{"type":"application/pdf","suffixes":"pdf"},{"type":"text/pdf","suffixes":"pdf"}]}],"duration":0},"vendor":{"value":"","duration":0},"cookiesEnabled":{"value":true,"duration":0},"colorGamut":{"value":"srgb","duration":0},"rendererUnmasked":{"value":"","duration":116},"brand":"","device":"","os_type":"desktop","os_family":"Windows","front_browser_family":"Firefox","front_browser_name":"Firefox 134","pixel_ratio":1}

12:24:43.555 GET 200 script 594.4 KB 22 ms 1 alerts

12:24:43.559 GET 200 xhr 0 B 46 ms 2 alerts

12:24:43.578 OPTIONS 204 xhr 0 B 294 ms —

12:24:43.762 POST 200 xhr 85.0 KB 593 ms —

12:24:43.887 GET 302 img 0 B 289 ms —

12:24:44.081 GET 302 img 0 B 59 ms —

12:24:44.147 GET 403 img 0 B 72 ms —

12:24:44.194 GET 200 img 43 B 52 ms —

12:24:44.420 GET 200 img 486 B 140 ms —

12:24:44.423 GET 200 img 1.0 KB 159 ms —

12:24:44.427 GET 200 img 0 B 44 ms —

12:24:44.449 GET 200 img 0 B 36 ms —

12:24:44.503 GET 200 img 3.1 KB 163 ms —

12:24:44.505 GET 302 img 870 B 88 ms —

12:24:44.637 GET 200 img 870 B 19 ms —

http://epawg.com/videos/689791/oreob4by-anal-play/

Domain graph

Hostnames

Connections

Network requests

Transaction #36

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Request body

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://epawg.com/videos/689791/oreob4by-anal-play/

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #36

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Request body

http://epawg.com/videos/689791/oreob4by-anal-play/

Domain graph

Network requests