WEBSITE ANALYSIS REPORT

http://epawg.com/videos/689791/oreob4by-anal-play/

30 May 2026 · 12:25:04.000 UTCpublic

Report tags
Submit tags

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

657ed82b34.ce7609977e.com4 captured requests
a64842e9de.198b531aae.com1 captured requests
accounts.google.com3 captured requests
epawg.com16 captured requests
flushpersist.com1 captured requests
fonts.googleapis.com1 captured requests
fonts.gstatic.com1 captured requests
fp.metricswpsh.com2 captured requests
js.capndr.com1 captured requests
js.wpadmngr.com1 captured requests
js.wpushsdk.com2 captured requests
na.nawpush.com1 captured requests
nereserv.com1 captured requests
ntvpforever.com2 captured requests
p.a64x.com1 captured requests
picdn.vip2 captured requests
pl22022116.toprevenuegate.com1 captured requests
preferencenail.com1 captured requests
protrafficinspector.com2 captured requests
realizationnewestfangs.com1 captured requests
static.bookmsg.com2 captured requests

Connections

epawg.com → 657ed82b34.ce7609977e.comCalls2 captured connections
epawg.com → 657ed82b34.ce7609977e.comLoads from2 captured connections
epawg.com → a64842e9de.198b531aae.comCalls1 captured connections
epawg.com → accounts.google.comLoads from3 captured connections
epawg.com → flushpersist.comLoads from1 captured connections
epawg.com → fonts.googleapis.comLoads from1 captured connections
epawg.com → fonts.gstatic.comLoads from1 captured connections
epawg.com → fp.metricswpsh.comCalls2 captured connections
epawg.com → js.capndr.comLoads from1 captured connections
epawg.com → js.wpadmngr.comLoads from1 captured connections
epawg.com → js.wpushsdk.comLoads from2 captured connections
epawg.com → na.nawpush.comCalls1 captured connections
epawg.com → nereserv.comCalls1 captured connections
epawg.com → ntvpforever.comCalls2 captured connections
epawg.com → p.a64x.comLoads from1 captured connections
epawg.com → picdn.vipLoads from2 captured connections
epawg.com → pl22022116.toprevenuegate.comLoads from1 captured connections
epawg.com → preferencenail.comLoads from1 captured connections
epawg.com → protrafficinspector.comCalls2 captured connections
epawg.com → realizationnewestfangs.comLoads from1 captured connections
epawg.com → static.bookmsg.comLoads from2 captured connections
p.a64x.com → picdn.vipRedirects to1 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

12:24:41.395 GET 200 document 36.9 KB 218 ms —

12:24:41.735 GET 200 stylesheet 5.6 KB 254 ms —

12:24:41.738 GET 200 stylesheet 134.7 KB 43 ms —

12:24:41.740 GET 200 stylesheet 5.3 KB 89 ms —

12:24:41.743 GET 200 script 95.4 KB 743 ms 3 alerts

12:24:41.745 GET 200 script 132.8 KB 221 ms 1 alerts

12:24:41.746 GET 200 img 9.0 KB 35 ms —

12:24:41.748 GET 200 script 161.7 KB 75 ms —

12:24:41.750 GET 200 img 6.6 KB 51 ms —

12:24:41.751 GET 200 script 204.0 KB 97 ms —

12:24:41.972 GET 200 font 21.7 KB 193 ms —

12:24:42.265 GET 200 img 0 B 652 ms 1 alerts

12:24:42.269 GET 200 script 83.4 KB 176 ms 2 alerts

Transaction #47

Request / response

URL

GET HTTPS

https://preferencenail.com/sfp.js

IP / ASN

185.196.197.71

AS39572 · DataWeb Global Group B.V.

Requested by: https://epawg.com/videos/689791/oreob4by-anal-play/

Resource information

File type: JavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
MIME type: application/javascript; charset=utf-8
First seen (UTC): 18 Nov 2025 · 17:36:30.149 UTC
Last seen (UTC): 03 Sep 2026 · 10:37:11.150 UTC
Times seen: 27836

Size: 83.4 KB (85379 bytes)
MD5: b3a5ba94d627e64a77c0e11eaffc96ed
SHA1: f7358693b31e44211dd98b5aa0dc2a3f423286aa
SHA256: 600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34

Certificate information

Issuer: Let's Encrypt · R12
Subject: preferencenail.com
Protocol / cipher: TLSv1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
SHA1 fingerprint: 95:86:03:59:0E:03:98:91:87:F0:07:36:44:10:95:8E:67:97:47:D8
Valid from: Tue, 28 Apr 2026 01:34:17 GMT
Valid until: Mon, 27 Jul 2026 01:34:16 GMT

Technology fingerprints

Nginx:1.28.2 (Web servers, Reverse proxies)
HSTS (Security)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
Hagezi Threat Feed Sinkholed	medium	Malicious
Cloudflare DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /sfp.js HTTP/1.1
Host: preferencenail.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://epawg.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Server: nginx/1.28.2
Date: Sat, 30 May 2026 12:24:42 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 32181
Connection: keep-alive
Content-Encoding: gzip
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Vary: Accept-Encoding
Host: preferencenail.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
X-Request-ID: 9b2837419f63d55032f25b3e13241197
Cache-Control: no-cache, max-age=0, private, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=0; includeSubdomains

12:24:42.271 GET 200 xhr 40 B 296 ms —

12:24:42.324 GET 200 stylesheet 28.6 KB 44 ms —

12:24:42.346 GET 200 img 3.1 KB 43 ms —

12:24:42.423 GET 200 font 9.3 KB 51 ms —

12:24:42.486 GET 200 img 43 B 48 ms —

12:24:42.523 GET 200 xhr 1.4 KB 176 ms 1 alerts

12:24:42.530 GET 200 script 0 B 197 ms 1 alerts

12:24:42.734 GET 200 img 4.2 KB 33 ms —

12:24:42.771 GET 200 xhr 40 B 21 ms —

12:24:43.032 GET 200 font 2.2 KB 69 ms —

12:24:43.124 GET 200 img 59.0 KB 61 ms —

12:24:43.165 OPTIONS 204 xhr 0 B 251 ms —

12:24:43.182 GET 200 xhr 0 B 273 ms —

12:24:43.193 GET 200 script 253.6 KB 224 ms 1 alerts

12:24:43.197 OPTIONS 204 xhr 0 B 243 ms 1 alerts

12:24:43.198 GET 200 img 43 B 47 ms —

12:24:43.262 GET 200 img 0 B 696 ms 2 alerts

12:24:43.361 POST 200 xhr 57 B 33 ms —

12:24:43.488 POST 200 xhr 58 B 258 ms 1 alerts

12:24:43.555 GET 200 script 594.4 KB 22 ms 1 alerts

12:24:43.559 GET 200 xhr 0 B 46 ms 2 alerts

12:24:43.578 OPTIONS 204 xhr 0 B 294 ms —

12:24:43.762 POST 200 xhr 85.0 KB 593 ms —

12:24:43.887 GET 302 img 0 B 289 ms —

12:24:44.081 GET 302 img 0 B 59 ms —

12:24:44.147 GET 403 img 0 B 72 ms —

12:24:44.194 GET 200 img 43 B 52 ms —

12:24:44.420 GET 200 img 486 B 140 ms —

12:24:44.423 GET 200 img 1.0 KB 159 ms —

12:24:44.427 GET 200 img 0 B 44 ms —

12:24:44.449 GET 200 img 0 B 36 ms —

12:24:44.503 GET 200 img 3.1 KB 163 ms —

12:24:44.505 GET 302 img 870 B 88 ms —

12:24:44.637 GET 200 img 870 B 19 ms —

http://epawg.com/videos/689791/oreob4by-anal-play/

Domain graph

Hostnames

Connections

Network requests

Transaction #47

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://epawg.com/videos/689791/oreob4by-anal-play/

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #47

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://epawg.com/videos/689791/oreob4by-anal-play/

Domain graph

Network requests