anonymfile.com/mkJOo/rbxphishing.exe
301 Moved Permanently 162 B URL HTTP/1.1 anonymfile.com/mkJOo/rbxphishing.exe
IP
ASN #24940 Hetzner Online GmbH
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4f8e702cc244ec5d4de32740c0ecbd97
3adb1f02d5b6054de0046e367c1d687b6cdf7aff
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
GET /mkJOo/rbxphishing.exe HTTP/1.1
Host: anonymfile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sun, 27 Nov 2022 16:54:01 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://anonymfile.com/mkJOo/rbxphishing.exe
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash cdbad2434b7d127a4fc769807a9dc3e7
fa98cd9fc2309ab4423f33f683d17bdb17d76713
560cbbb751ab2884024da3b93fba6bc45c6434797dba72a98c05e7fc2bb94bc1
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "560CBBB751AB2884024DA3B93FBA6BC45C6434797DBA72A98C05E7FC2BB94BC1"
Last-Modified: Sat, 26 Nov 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11557
Expires: Sun, 27 Nov 2022 20:06:38 GMT
Date: Sun, 27 Nov 2022 16:54:01 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash 64b2a23eab6e5ae8c010ec7242be930c
0673e4385ba01a5a245711bab96cafc34f765793
64751d193f7af72431e9689581faffcae1a30ff50ea425697b2b80ff61c87909
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2139
Cache-Control: max-age=151971
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 16:54:01 GMT
Etag: "63833c71-1d7"
Expires: Tue, 29 Nov 2022 11:06:52 GMT
Last-Modified: Sun, 27 Nov 2022 10:31:13 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 71f9c681a82440fd55e76c780a20e55d
3147768cfbcdd06e0c6e69684292e68e99917a80
5ea71ce6dd9e927f9bb3f97f59cc1ac7dc25a949024815965b29bc5835614786
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5EA71CE6DD9E927F9BB3F97F59CC1AC7DC25A949024815965B29BC5835614786"
Last-Modified: Sat, 26 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17174
Expires: Sun, 27 Nov 2022 21:40:15 GMT
Date: Sun, 27 Nov 2022 16:54:01 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash d130218d0e2841f39c99610fe1a2ab90
29fbe1e177ee55c7a61ae0a206afff271cf5f945
6b6d74dccf10c2bc98a91c3388280d7ba1d9596bf8cadd7db0e2f63720b3d152
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Alert, Content-Type, Retry-After, Content-Length
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sun, 27 Nov 2022 16:17:40 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 2181
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: ASRW9HCCZSradJTbRT/X/NmdW7jC5AdQLeRKlR3sPA3G0KVmndktr8KWuS7PXAJI07T4rnkzTfYf1yroQLvPwA==
x-amz-request-id: 5YV0FXC9Q9E3JTF8
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 27 Nov 2022 16:41:42 GMT
age: 739
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:01 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
anonymfile.com/css/theme.min.css
200 OK 75 kB URL HTTP/2 anonymfile.com/css/theme.min.css
IP
ASN #24940 Hetzner Online GmbH
File type Unicode text, UTF-8 text, with very long lines (65533), with no line terminators
Hash 8b61cc26bfb7e13d1ebf3e9639914e51
7b8d4de2b1884b3c1654cfbde0e8a6f3885a3f66
f27b9cd4b89d6729e328f65b08114323077a61b6761865aa160785073f57bbb0
GET /css/theme.min.css HTTP/1.1
Host: anonymfile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/mkJOo/rbxphishing.exe
Cookie: XSRF-TOKEN=eyJpdiI6Ik5Fd3hBR3JOQ3lIcS9uR2NYMU5QS3c9PSIsInZhbHVlIjoibGw4UDRSWHVHWnNUZG5RWURpUk96NXhOQVJQR2dwU21PWjNEbTZWS3QvRzA4UjF5ei80Rmt5dU9NenZYczFlMkw3NkhhVFNsZnFySHh6cTFGWDFFcG9SWG5HVGxYOU4xOFFtbktzL2g1N2RtZ21sMllTbEZDZGdOK0IrQW90SWgiLCJtYWMiOiJjOTAxODFhYzcxYTYyNmU3MGIxMDYwNjI2NWJkMTY5YjUxNjk3Yzc1YzhiMWNiZTQ4OGQ4M2YxNjdmZDU1NzkwIiwidGFnIjoiIn0%3D; anonymfile_session=eyJpdiI6Ik5Bc2NZb3hkK3ZrcjJtTnJkRS9Zc1E9PSIsInZhbHVlIjoidmlWTWlYNDk2V2RTdUpUR2xGR1l5OENEdkcvL3RMSlZHbUhudFcrVFUxR3hqZkdmM0Z1WWZvQ2ZMM0FCQ2dnZWE4UGlxTmhxQWREaTVnalhYZTUrbDFMUTRQcmlrdmZyb0tCZFQwUVkzUXZScXZJcGlidFkzd0hrVERyVUpYS2siLCJtYWMiOiI4YmViZDE0M2JiMmI2MmVkYjYzZDAxN2M4ZjlhNDY1ZTUyN2FkODM0ZGM1MmIzMzZlMjQxMWMxM2VjNzY3MmQ1IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: text/css
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-original-content-length: 598523
vary: Accept-Encoding
content-encoding: gzip
content-length: 74661
etag: W/"PSA-aj-TDax0QZn8Y"
date: Sun, 27 Nov 2022 16:54:01 GMT
expires: Sun, 27 Nov 2022 16:57:51 GMT
cache-control: max-age=229
X-Firefox-Spdy: h2
anonymfile.com/img/logo-anon-warning.webp
200 OK 15 kB URL HTTP/2 anonymfile.com/img/logo-anon-warning.webp
IP
ASN #24940 Hetzner Online GmbH
File type RIFF (little-endian) data, Web/P image\012- data
Hash 7b596f481388ac5ef6d74a15a351f6c3
6756e88c0b46cc981b7bbbdaf2ead77bd258a472
cd830cff1dfb9af2181dfe61645addbe21981954713fba54d5875a038e673972
GET /img/logo-anon-warning.webp HTTP/1.1
Host: anonymfile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/mkJOo/rbxphishing.exe
Cookie: XSRF-TOKEN=eyJpdiI6Ik5Fd3hBR3JOQ3lIcS9uR2NYMU5QS3c9PSIsInZhbHVlIjoibGw4UDRSWHVHWnNUZG5RWURpUk96NXhOQVJQR2dwU21PWjNEbTZWS3QvRzA4UjF5ei80Rmt5dU9NenZYczFlMkw3NkhhVFNsZnFySHh6cTFGWDFFcG9SWG5HVGxYOU4xOFFtbktzL2g1N2RtZ21sMllTbEZDZGdOK0IrQW90SWgiLCJtYWMiOiJjOTAxODFhYzcxYTYyNmU3MGIxMDYwNjI2NWJkMTY5YjUxNjk3Yzc1YzhiMWNiZTQ4OGQ4M2YxNjdmZDU1NzkwIiwidGFnIjoiIn0%3D; anonymfile_session=eyJpdiI6Ik5Bc2NZb3hkK3ZrcjJtTnJkRS9Zc1E9PSIsInZhbHVlIjoidmlWTWlYNDk2V2RTdUpUR2xGR1l5OENEdkcvL3RMSlZHbUhudFcrVFUxR3hqZkdmM0Z1WWZvQ2ZMM0FCQ2dnZWE4UGlxTmhxQWREaTVnalhYZTUrbDFMUTRQcmlrdmZyb0tCZFQwUVkzUXZScXZJcGlidFkzd0hrVERyVUpYS2siLCJtYWMiOiI4YmViZDE0M2JiMmI2MmVkYjYzZDAxN2M4ZjlhNDY1ZTUyN2FkODM0ZGM1MmIzMzZlMjQxMWMxM2VjNzY3MmQ1IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: image/webp
content-length: 15344
etag: "617d3713-3bf0"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
accept-ranges: bytes
date: Sun, 27 Nov 2022 16:52:51 GMT
expires: Sun, 27 Nov 2022 16:57:51 GMT
X-Firefox-Spdy: h2
anonymfile.com/img/main/footer.webp
200 OK 178 kB URL HTTP/2 anonymfile.com/img/main/footer.webp
IP
ASN #24940 Hetzner Online GmbH
File type RIFF (little-endian) data, Web/P image\012- data
Size 178 kB (178070 bytes)
Hash 79ccb3a1b78412a1a530284f45ea7056
626d0494e1bd871e67ecffad44d04ac2343fb7e5
3d4e83b59664d7a779fa777d4ee0e17a1bc09302f9b9cde60815a3142256d8b8
GET /img/main/footer.webp HTTP/1.1
Host: anonymfile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/mkJOo/rbxphishing.exe
Cookie: XSRF-TOKEN=eyJpdiI6Ik5Fd3hBR3JOQ3lIcS9uR2NYMU5QS3c9PSIsInZhbHVlIjoibGw4UDRSWHVHWnNUZG5RWURpUk96NXhOQVJQR2dwU21PWjNEbTZWS3QvRzA4UjF5ei80Rmt5dU9NenZYczFlMkw3NkhhVFNsZnFySHh6cTFGWDFFcG9SWG5HVGxYOU4xOFFtbktzL2g1N2RtZ21sMllTbEZDZGdOK0IrQW90SWgiLCJtYWMiOiJjOTAxODFhYzcxYTYyNmU3MGIxMDYwNjI2NWJkMTY5YjUxNjk3Yzc1YzhiMWNiZTQ4OGQ4M2YxNjdmZDU1NzkwIiwidGFnIjoiIn0%3D; anonymfile_session=eyJpdiI6Ik5Bc2NZb3hkK3ZrcjJtTnJkRS9Zc1E9PSIsInZhbHVlIjoidmlWTWlYNDk2V2RTdUpUR2xGR1l5OENEdkcvL3RMSlZHbUhudFcrVFUxR3hqZkdmM0Z1WWZvQ2ZMM0FCQ2dnZWE4UGlxTmhxQWREaTVnalhYZTUrbDFMUTRQcmlrdmZyb0tCZFQwUVkzUXZScXZJcGlidFkzd0hrVERyVUpYS2siLCJtYWMiOiI4YmViZDE0M2JiMmI2MmVkYjYzZDAxN2M4ZjlhNDY1ZTUyN2FkODM0ZGM1MmIzMzZlMjQxMWMxM2VjNzY3MmQ1IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: image/webp
content-length: 178070
etag: "62f35b9c-2b796"
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
accept-ranges: bytes
date: Sun, 27 Nov 2022 16:52:51 GMT
expires: Sun, 27 Nov 2022 16:57:51 GMT
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 280 B IP
Hash ebed87c2caeb00f3daca76b91f1d5856
0b524def376f7bf90143e8c002fbbdc776d4b457
9d50a898f0edaf6c38ef9827dcfc72de00b8afd71fde693644c3e7424f6efaa4
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5818
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 16:54:02 GMT
Last-Modified: Sun, 27 Nov 2022 15:17:04 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 280
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta2/css/all.min.css
200 OK 14 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta2/css/all.min.css
IP
File type ASCII text, with very long lines (65345)
Hash 642445b86596bdeaa98e92faa2064fc6
6c5539660bf533d34e37b917973c941d1c963374
4a5a39e9f325c5578dccd880c1d516eae190ee39f7539f4a6c6c52d2eee4cbdf
GET /ajax/libs/font-awesome/6.0.0-beta2/css/all.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: text/css; charset=utf-8
content-length: 14374
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61498362-3826"
last-modified: Tue, 21 Sep 2021 07:01:54 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 10447960
expires: Fri, 17 Nov 2023 16:54:02 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BSPIKRBwuC2bl4iU8BYsr91ZWwK4Q3fcqWWh7pmlssk3MVyU1xK6xjgNjiE0hbBSQnekIxgZaPL1ShT%2F8bjpEgbmUXWP0mrz%2BNqsfafXNkoQUQXWOqlIq%2BFkp5%2FTq8Qo9eqFDpJs"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 770c62271b19b50f-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnjs.cloudflare.com/ajax/libs/filepond/4.30.3/filepond.min.js
200 OK 30 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/filepond/4.30.3/filepond.min.js
IP
File type ASCII text, with very long lines (65370)
Hash d18c98bb03dac8dd996130d56f3d8e8c
cc1777baef75c9438534927036a21f22e91e5578
89a5585efd3c48a3870d383705937d51bb2a3a776eb01805a2629dd7a28e3c2e
GET /ajax/libs/filepond/4.30.3/filepond.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: application/javascript; charset=utf-8
content-length: 29707
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "615c7e96-740b"
last-modified: Tue, 05 Oct 2021 16:34:30 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 10611930
expires: Fri, 17 Nov 2023 16:54:02 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gdbMm0mjM5XMu98883ado6U0qWEvHvdcVug4rPkwcbCEvT4DhWMDUlk%2B8TbpBM%2FOF7hA7zYpvcviN%2B15KnTfvEwdBz5eni7srxctTQWKd5SYKoqukmvegxaGuxrFzLcT8%2FmcNuag"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 770c62273b37b50f-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Pragma, Alert, Content-Type, ETag, Retry-After, Last-Modified, Content-Length, Cache-Control, Expires
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sun, 27 Nov 2022 16:08:54 GMT
cache-control: public,max-age=3600
age: 2708
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
cdnjs.cloudflare.com/ajax/libs/popper.js/2.10.2/umd/popper.min.js
200 OK 6.0 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/popper.js/2.10.2/umd/popper.min.js
IP
File type ASCII text, with very long lines (18706)
Hash 3773d4bd82b03cdfd02c9fd691f80d78
c4d89a2de179c90944835571b45877048f3c1424
5d05303e3777fd4f588b7167d0a22cd5ca499c238f78ec0cecbb3a8786de332d
GET /ajax/libs/popper.js/2.10.2/umd/popper.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: application/javascript; charset=utf-8
content-length: 6037
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "6155af49-1795"
last-modified: Thu, 30 Sep 2021 12:36:25 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1449982
expires: Fri, 17 Nov 2023 16:54:02 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7xX8XmIbPimGXn7mEQLbPedkv3noNdmvG0szBGawwAkpWR%2Fks%2FjNjwThmLuAIz3RBrppIeTU1mzm%2BWhESmktsBeOaP4oDXmArviZubsHqIBSEhgYrjX6CDHraW2bw9ZwQW0IBP89"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 770c62274b46b50f-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 280 B IP
Hash ebed87c2caeb00f3daca76b91f1d5856
0b524def376f7bf90143e8c002fbbdc776d4b457
9d50a898f0edaf6c38ef9827dcfc72de00b8afd71fde693644c3e7424f6efaa4
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5818
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 16:54:02 GMT
Last-Modified: Sun, 27 Nov 2022 15:17:04 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 280
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
200 OK 28 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
IP
File type ASCII text, with very long lines (65447)
Hash d900ca08873ee57d40616d39a44cc0aa
7ab3ac8b1504b7b914a6e94c979b8390bb492f6a
1eea479cc0abe04a0846f41031207f9511f12ffef017a6109d4efb6f5523465b
GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: application/javascript; charset=utf-8
content-length: 27938
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "603e8adc-15d9d"
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1381767
expires: Fri, 17 Nov 2023 16:54:02 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U3Yw%2BHeT2Fo8gHuWhu%2FRN%2FSlOLFFDBHQKqpE%2BNUriOhmRvYmBRiMsgnjfhC3JuH45jBAj12vvnUCooy0tZZsZtOuvqCG9tIqg2wcz6o2pNRGt2EyUfiQhmcKPGjAIpMD1uVJnBWU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 770c62274b45b50f-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnjs.cloudflare.com/ajax/libs/bootstrap/5.1.3/js/bootstrap.min.js
200 OK 15 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/bootstrap/5.1.3/js/bootstrap.min.js
IP
File type ASCII text, with very long lines (58940)
Hash 28dbaeb9aa2638e0c4e6d9ffd3d14e9d
3208ed3741e60986bbed3fd759cdfd3b4fa7cf06
ababbb021f57966e125b8e296f9515f38d906b462697f7835e6914465dd0d362
GET /ajax/libs/bootstrap/5.1.3/js/bootstrap.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: application/javascript; charset=utf-8
content-length: 14584
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "6161dfe3-38f8"
last-modified: Sat, 09 Oct 2021 18:30:59 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 949783
expires: Fri, 17 Nov 2023 16:54:02 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XBHH5mjAG7jZg%2FRm%2BnKTIp4NRwZ%2BZDuQ5fEBEBOuCOaKb4vd4FO8wn53MywZu%2Fdr%2B5EwiA1VSa2obUkxSzG%2BSpLBrLO7ncS%2FVTq%2Fwl0d8BpUGlV7tvlC5VCAeICM2xOywnuJ%2Bb%2BQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 770c62275b4fb50f-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnjs.cloudflare.com/ajax/libs/clipboard.js/2.0.8/clipboard.min.js
200 OK 3.0 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/clipboard.js/2.0.8/clipboard.min.js
IP
File type Unicode text, UTF-8 text, with very long lines (10584)
Hash e34a4db0b42ca907e0b7a56cd4b145ec
2dc36a7dcdfc42d122b23ef91483d27865c4285f
4b2a908e8d2c23d19da5e9ef4c6c77e7c6e8823b7aeb93233723f366ff6d217a
GET /ajax/libs/clipboard.js/2.0.8/clipboard.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: application/javascript; charset=utf-8
content-length: 3000
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "6049431e-29b4"
last-modified: Wed, 10 Mar 2021 22:07:26 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 2157907
expires: Fri, 17 Nov 2023 16:54:02 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gFG7JF9DsKpsUokAYLnOBrZccsDrLJUblA%2FOmnrx4tt4Ds95Re4Ty0ezLGoxcpFYjPa5%2F8JqVTlawweJWzwh16zFw05xOBlirygfwIQ0s9hJlNlt%2FtvM36IsgFzYhdQYJJjdmeuY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 770c62275b50b50f-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 278 B IP
Hash efb85bdb2274abf336f4748eeb5d6bdc
6810b0f697c246d93648d569172e234376f3c2fe
f8af0676272c238c5eb8e2a65d932d5f5e8eebea3069c443da5edecbd114951b
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4703
Cache-Control: max-age=170361
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 16:54:02 GMT
Etag: "63837a44-116"
Expires: Tue, 29 Nov 2022 16:13:23 GMT
Last-Modified: Sun, 27 Nov 2022 14:55:00 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 278
anonymfile.com/js/site.js
200 OK 2.0 kB URL HTTP/2 anonymfile.com/js/site.js
IP
ASN #24940 Hetzner Online GmbH
File type ASCII text, with very long lines (5640)
Hash a779d1605363c034784168e0553fee12
203adaeac5eec419f7bdf4ba6840c9378c9692e5
0ac5db7b1ae244540526d4c971799e4c8ba3f5921dda88b94d10d2cb6a730bc6
GET /js/site.js HTTP/1.1
Host: anonymfile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/mkJOo/rbxphishing.exe
Cookie: XSRF-TOKEN=eyJpdiI6Ik5Fd3hBR3JOQ3lIcS9uR2NYMU5QS3c9PSIsInZhbHVlIjoibGw4UDRSWHVHWnNUZG5RWURpUk96NXhOQVJQR2dwU21PWjNEbTZWS3QvRzA4UjF5ei80Rmt5dU9NenZYczFlMkw3NkhhVFNsZnFySHh6cTFGWDFFcG9SWG5HVGxYOU4xOFFtbktzL2g1N2RtZ21sMllTbEZDZGdOK0IrQW90SWgiLCJtYWMiOiJjOTAxODFhYzcxYTYyNmU3MGIxMDYwNjI2NWJkMTY5YjUxNjk3Yzc1YzhiMWNiZTQ4OGQ4M2YxNjdmZDU1NzkwIiwidGFnIjoiIn0%3D; anonymfile_session=eyJpdiI6Ik5Bc2NZb3hkK3ZrcjJtTnJkRS9Zc1E9PSIsInZhbHVlIjoidmlWTWlYNDk2V2RTdUpUR2xGR1l5OENEdkcvL3RMSlZHbUhudFcrVFUxR3hqZkdmM0Z1WWZvQ2ZMM0FCQ2dnZWE4UGlxTmhxQWREaTVnalhYZTUrbDFMUTRQcmlrdmZyb0tCZFQwUVkzUXZScXZJcGlidFkzd0hrVERyVUpYS2siLCJtYWMiOiI4YmViZDE0M2JiMmI2MmVkYjYzZDAxN2M4ZjlhNDY1ZTUyN2FkODM0ZGM1MmIzMzZlMjQxMWMxM2VjNzY3MmQ1IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/javascript
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-original-content-length: 9351
vary: Accept-Encoding
content-encoding: gzip
content-length: 1993
etag: W/"PSA-aj-ZD_qAZjk-5"
date: Sun, 27 Nov 2022 16:54:02 GMT
expires: Sun, 27 Nov 2022 16:57:51 GMT
cache-control: max-age=228
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 278 B IP
Hash efb85bdb2274abf336f4748eeb5d6bdc
6810b0f697c246d93648d569172e234376f3c2fe
f8af0676272c238c5eb8e2a65d932d5f5e8eebea3069c443da5edecbd114951b
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4703
Cache-Control: max-age=170361
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 16:54:02 GMT
Etag: "63837a44-116"
Expires: Tue, 29 Nov 2022 16:13:23 GMT
Last-Modified: Sun, 27 Nov 2022 14:55:00 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 278
cdnjs.cloudflare.com/ajax/libs/filepond/4.29.1/filepond.min.css
200 OK 2.9 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/filepond/4.29.1/filepond.min.css
IP
File type assembler source, ASCII text, with very long lines (17282)
Hash 78aabb09e30a9eb6f833cbb1b48bdb2e
e876ff16b6c511bc217973e51202aaaf23a4e936
8d76a29a92bc268043a7bd4d0b8f171fffd6c6c3c8e18aa314d6dac1aeb542ae
GET /ajax/libs/filepond/4.29.1/filepond.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://anonymfile.com
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: text/css; charset=utf-8
content-length: 2934
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "613afc53-b76"
last-modified: Fri, 10 Sep 2021 06:33:55 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 361732
expires: Fri, 17 Nov 2023 16:54:02 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nBblOPFyiwnZzibcsDSVl4Cgtg2oZrSh84k%2FTmjvZ9cIWJx9K60L%2BHxyDOm%2FpZEosO0vYT0VA0kCNB8URbu5AY93kauvN80vjb%2FCnURAEZM1yT2KznTza49FuPJNRsFyAkzPtdAz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 770c62278d40b4fd-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
code.jquery.com/jquery-3.6.0.min.js
200 OK 31 kB URL HTTP/2 code.jquery.com/jquery-3.6.0.min.js
IP
File type ASCII text, with very long lines (65447)
Hash 899f0189aaf034bbba5340f724d91dfa
210ea9de03968edb9d839ba4a0ce2d48666a8ab8
949b6597c5ea907a7ef3c8ca6d5ffc73be2352f9df485b78704e5c4dabac5d0f
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 27 Nov 2022 16:54:02 GMT
content-encoding: gzip
content-length: 30875
content-type: application/javascript; charset=utf-8
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
accept-ranges: bytes
server: nginx
etag: W/"611feac9-15d9d"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1669568042.dop022.sk1.t,1669568042.cds224.sk1.hn,1669568042.cds210.sk1.c
X-Firefox-Spdy: h2
unpkg.com/filepond-plugin-file-validate-size/dist/filepond-plugin-file-validate-size.js
302 Found 2.0 kB URL HTTP/2 unpkg.com/filepond-plugin-file-validate-size/dist/filepond-plugin-file-validate-size.js
IP
Hash c2b70cb30928ad0328eba471ca289c0a
f743bc4f5b9d6486be5ee0440e253064b534804d
f2d672dd277d5099483b74ef6ffd74c39935b0324cce573136ab9a11e5cb7b51
GET /filepond-plugin-file-validate-size/dist/filepond-plugin-file-validate-size.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=600, max-age=60
location: /filepond-plugin-file-validate-size@2.2.7/dist/filepond-plugin-file-validate-size.js
vary: Accept, Accept-Encoding
via: 1.1 fly.io
fly-request-id: 01GJX0556QYF047QSAV867J8Z9-ams
cf-cache-status: EXPIRED
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 770c62279c220afe-OSL
X-Firefox-Spdy: h2
code.jquery.com/jquery-3.6.0.min.js
200 OK 31 kB URL HTTP/2 code.jquery.com/jquery-3.6.0.min.js
IP
File type ASCII text, with very long lines (65447)
Hash 899f0189aaf034bbba5340f724d91dfa
210ea9de03968edb9d839ba4a0ce2d48666a8ab8
949b6597c5ea907a7ef3c8ca6d5ffc73be2352f9df485b78704e5c4dabac5d0f
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://anonymfile.com
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 27 Nov 2022 16:54:02 GMT
content-encoding: gzip
content-length: 30875
content-type: application/javascript; charset=utf-8
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
accept-ranges: bytes
server: nginx
etag: W/"611feac9-15d9d"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1669568042.dop227.sk1.t,1669568042.cds215.sk1.hn,1669568042.cds210.sk1.c
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash a6fee11dfe1b88cd768a0ca3e2bd0c89
59cec9a44a4a92467678afe65f347f68641a2174
50870c499aae4d5dfd6df25a36cd04b6d185b66ef0590e46933984bf52e2483f
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6540
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 16:54:02 GMT
Last-Modified: Sun, 27 Nov 2022 15:05:02 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 471
ocsp.digicert.com/
200 OK 280 B IP
Hash 275f0035de997821992b512cf1c41d0a
cd24fff9ab00012c1c23622ab1f86aaaf02da8c9
1a8dd40698e960be61c4284c14c9d7a30dc3fe89bbbbf60618e741688f9f0f4a
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6492
Cache-Control: max-age=96900
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 16:54:02 GMT
Etag: "63825452-118"
Expires: Mon, 28 Nov 2022 19:49:02 GMT
Last-Modified: Sat, 26 Nov 2022 18:00:50 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 280
cdnjs.cloudflare.com/ajax/libs/filepond/4.30.3/filepond.min.js
200 OK 30 kB URL HTTP/2 cdnjs.cloudflare.com/ajax/libs/filepond/4.30.3/filepond.min.js
IP
File type ASCII text, with very long lines (65370)
Hash d18c98bb03dac8dd996130d56f3d8e8c
cc1777baef75c9438534927036a21f22e91e5578
89a5585efd3c48a3870d383705937d51bb2a3a776eb01805a2629dd7a28e3c2e
GET /ajax/libs/filepond/4.30.3/filepond.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://anonymfile.com
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: application/javascript; charset=utf-8
content-length: 29707
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "615c7e96-740b"
last-modified: Tue, 05 Oct 2021 16:34:30 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 10611930
expires: Fri, 17 Nov 2023 16:54:02 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c13rtacZiTas5fpcHHHgIEsQWVvjJU6vxAGiTwSktbWBE%2FhI62VtXHOacx%2FrlkVLdDT9sGEYfrVhJ4izEzBMMG1eG2kOOmPjOaV2kJFJDl9yXEZxKP8mRDX1zdUYlD0UAFhs6XAu"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 770c6228ae7db4fd-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
anonymfile.com/img/logo-anon-warning.png
200 OK 22 kB URL HTTP/2 anonymfile.com/img/logo-anon-warning.png
IP
ASN #24940 Hetzner Online GmbH
File type PNG image data, 1024 x 1024, 8-bit colormap, non-interlaced\012- data
Hash 4332367bd6f2c12da86e4ab20157daef
027b329b8b50972ee035b4e4f3cb9a3c080aba31
a7a91652e8153a80b1270b5fdb1d1e1e880ad9580e298040df1ed1b024699eb4
GET /img/logo-anon-warning.png HTTP/1.1
Host: anonymfile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/mkJOo/rbxphishing.exe
Cookie: XSRF-TOKEN=eyJpdiI6Ik5Fd3hBR3JOQ3lIcS9uR2NYMU5QS3c9PSIsInZhbHVlIjoibGw4UDRSWHVHWnNUZG5RWURpUk96NXhOQVJQR2dwU21PWjNEbTZWS3QvRzA4UjF5ei80Rmt5dU9NenZYczFlMkw3NkhhVFNsZnFySHh6cTFGWDFFcG9SWG5HVGxYOU4xOFFtbktzL2g1N2RtZ21sMllTbEZDZGdOK0IrQW90SWgiLCJtYWMiOiJjOTAxODFhYzcxYTYyNmU3MGIxMDYwNjI2NWJkMTY5YjUxNjk3Yzc1YzhiMWNiZTQ4OGQ4M2YxNjdmZDU1NzkwIiwidGFnIjoiIn0%3D; anonymfile_session=eyJpdiI6Ik5Bc2NZb3hkK3ZrcjJtTnJkRS9Zc1E9PSIsInZhbHVlIjoidmlWTWlYNDk2V2RTdUpUR2xGR1l5OENEdkcvL3RMSlZHbUhudFcrVFUxR3hqZkdmM0Z1WWZvQ2ZMM0FCQ2dnZWE4UGlxTmhxQWREaTVnalhYZTUrbDFMUTRQcmlrdmZyb0tCZFQwUVkzUXZScXZJcGlidFkzd0hrVERyVUpYS2siLCJtYWMiOiI4YmViZDE0M2JiMmI2MmVkYjYzZDAxN2M4ZjlhNDY1ZTUyN2FkODM0ZGM1MmIzMzZlMjQxMWMxM2VjNzY3MmQ1IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: image/png
content-length: 21479
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
accept-ranges: bytes
x-original-content-length: 40729
etag: W/"PSA-aj-QzI2e9bywS"
date: Sun, 27 Nov 2022 16:54:02 GMT
expires: Sun, 27 Nov 2022 16:55:12 GMT
cache-control: max-age=69
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash c6bd82985c4427ff7e474c5c7c71e73c
f9cc525520b0d571cd3f143806c8a5f1ee0166fc
cb027063ba1c1ffa08eef4faee1640fcd8ae3890c10d4295fb06c2c8b408de94
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CB027063BA1C1FFA08EEF4FAEE1640FCD8AE3890C10D4295FB06C2C8B408DE94"
Last-Modified: Sat, 26 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7700
Expires: Sun, 27 Nov 2022 19:02:22 GMT
Date: Sun, 27 Nov 2022 16:54:02 GMT
Connection: keep-alive
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: AO/rYPcd01IhArUBkjtm4w==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: KjA9BqRYn1v0h2+H6Nn9w1p41Gk=
bedrapiona.com/5/5307591/?oo=1&js_build=iclick-v1.454.0
200 OK 1.7 kB URL HTTP/2 bedrapiona.com/5/5307591/?oo=1&js_build=iclick-v1.454.0
IP
Hash 1b7cae94b9586a142f027535683f0895
faf65ef50b7a75e172ef9d4ace92de0137d2082d
bf6827e399d5414a206f5624fd8320855da1b36f4b60c4a8aa7c9eb3fa040be5
GET /5/5307591/?oo=1&js_build=iclick-v1.454.0 HTTP/1.1
Host: bedrapiona.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://anonymfile.com
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: application/json
x-trace-id: 597ae5614cc59e00f5897c39960c3158
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://propeller-tracking.com>; rel="preconnect dns-prefetch",<https://diromalxx.com>; rel="preconnect dns-prefetch"
access-control-allow-origin: https://anonymfile.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-max-age: 86400
timing-allow-origin: *
set-cookie: OAID=f94259f68bbd4d36aa1a19f21bd552f9; expires=Mon, 27 Nov 2023 16:54:02 GMT; path=/; secure; SameSite=None
oaidts=1669568042; expires=Mon, 27 Nov 2023 16:54:02 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
pragma: no-cache, no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash edfdea84c823cedac82d72f35c163911
5b519c8aaaf4de1261ff11709da34f39428aa39a
d2b900f1dcda90417d369dae119a894c8dd4ba3a2a632914f348aa6df020e8a8
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D2B900F1DCDA90417D369DAE119A894C8DD4BA3A2A632914F348AA6DF020E8A8"
Last-Modified: Sat, 26 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10830
Expires: Sun, 27 Nov 2022 19:54:32 GMT
Date: Sun, 27 Nov 2022 16:54:02 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 39441102d05d0ccf7958cf4106ed4736
bccef58eac94c6d6fa0d0bb93af2ce9022e4da17
6e311fdb187f995362010ca45822bb7acee18b2d8ea2ff9f5580a2e8399f82ba
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6E311FDB187F995362010CA45822BB7ACEE18B2D8EA2FF9F5580A2E8399F82BA"
Last-Modified: Sun, 27 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9978
Expires: Sun, 27 Nov 2022 19:40:20 GMT
Date: Sun, 27 Nov 2022 16:54:02 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 46cdb4e62ca65c1190d3604219d0ae05
085bde67b3d401a53ca855ca3317d092e8a21cbf
e5ba20cbcda4c22b1ff4e250b49afb08ab2752349628e8144a248a1512beab29
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E5BA20CBCDA4C22B1FF4E250B49AFB08AB2752349628E8144A248A1512BEAB29"
Last-Modified: Sat, 26 Nov 2022 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=1490
Expires: Sun, 27 Nov 2022 17:18:52 GMT
Date: Sun, 27 Nov 2022 16:54:02 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 43dca8ebcf06bd09eb16b5516072ec48
84fe572e189c13383dc0a805a90c07de69c48ee6
be524e069364f1231ff9f6f8a5ca6ae8aa4353ba95fa7913c30c13ed008ab8fd
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BE524E069364F1231FF9F6F8A5CA6AE8AA4353BA95FA7913C30C13ED008AB8FD"
Last-Modified: Sat, 26 Nov 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8024
Expires: Sun, 27 Nov 2022 19:07:46 GMT
Date: Sun, 27 Nov 2022 16:54:02 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 279 B IP
Hash 8620cb50c13aa6595039feb6a940c719
87697510b8823d7312df41eaca3fd042a12bf96d
eda65270df7fee2cb4c1dcd7d5116c6e58918b7685ff2b2ef5e791c5b787a618
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4275
Cache-Control: max-age=146170
Content-Type: application/ocsp-response
Date: Sun, 27 Nov 2022 16:54:02 GMT
Etag: "63831d71-117"
Expires: Tue, 29 Nov 2022 09:30:12 GMT
Last-Modified: Sun, 27 Nov 2022 08:18:57 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 279
my.rtmark.net/gid.js?userId=f94259f68bbd4d36aa1a19f21bd552f9
200 OK 65 B URL HTTP/2 my.rtmark.net/gid.js?userId=f94259f68bbd4d36aa1a19f21bd552f9
IP
File type JSON data\012- , ASCII text
Hash 72fa6d482ef2cf7c12c7fbb378d6200c
671980c36b174a20ab66f4d27f1e85c4ff35412c
14d0994bbc495a6afac9fce37113251d2641e13e8fca851b4e877d6342a402be
GET /gid.js?userId=f94259f68bbd4d36aa1a19f21bd552f9 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://anonymfile.com
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: application/json; charset=utf-8
content-length: 65
access-control-allow-origin: https://anonymfile.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=f94259f68bbd4d36aa1a19f21bd552f9; expires=Mon, 27 Nov 2023 16:54:02 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
ibrapush.com/zone?pub=0&zone_id=5307590&is_mobile=false&domain=anonymfile.com&var=&ymid=&var_3=
200 OK 664 B URL HTTP/2 ibrapush.com/zone?pub=0&zone_id=5307590&is_mobile=false&domain=anonymfile.com&var=&ymid=&var_3=
IP
File type JSON data\012- , ASCII text, with very long lines (663)
Hash 924f83d583902548517c3327ff8e4493
7d5ea76f95d862b44558e6428f0a0d2bb20e2b0c
92e16e70459ff85e5803ded19d1f535cb6197a2b1eda7b254cb663b81908147c
GET /zone?pub=0&zone_id=5307590&is_mobile=false&domain=anonymfile.com&var=&ymid=&var_3= HTTP/1.1
Host: ibrapush.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://anonymfile.com/
Origin: https://anonymfile.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: application/json; charset=utf-8
content-length: 664
x-trace-id: a2ec92927d0d06971789d714be58eb4b
access-control-allow-origin: https://anonymfile.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
nanouwho.com/27/22b0ff6d446d45dfe24f0ae457b1c7db
200 OK 123 kB URL HTTP/2 nanouwho.com/27/22b0ff6d446d45dfe24f0ae457b1c7db
IP
File type ASCII text, with very long lines (65523)
Size 123 kB (123031 bytes)
Hash a872c0c51efd65b15def4acad64a0151
322a63a33a0b9d7349060431d9a0059c324a8b07
196f0c16e01e497c8fc265534d06c1182824c36477e079616a42da81af32fe31
Analyzer Verdict Alert quad9 Sinkholed
GET /27/22b0ff6d446d45dfe24f0ae457b1c7db HTTP/1.1
Host: nanouwho.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Cookie: scm=1; OAID=4031b5b2896044aea6012946043e54e7; oaidts=1669568042
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: application/javascript
access-control-allow-credentials: true
access-control-allow-origin:
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-Sc, CVERSION, VERSION
cache-control: max-age:290304000, public
last-modified: Fri, 25 Nov 2022 08:14:39 GMT
expires: Fri, 25 Dec 2082 08:14:39 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
content-encoding: gzip
X-Firefox-Spdy: h2
ibrapush.com/custom
200 OK 0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /custom HTTP/1.1
Host: ibrapush.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://anonymfile.com/
Origin: https://anonymfile.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:03 GMT
content-type: text/plain; charset=utf-8
content-length: 0
access-control-allow-origin: https://anonymfile.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-max-age: 86400
X-Firefox-Spdy: h2
ibrapush.com/pfe/current/tag.min.js?z=5307590
200 OK 40 kB URL HTTP/2 ibrapush.com/pfe/current/tag.min.js?z=5307590
IP
Hash a8a6798873cd6c214846535122f901aa
07513d3592f6b6a2f0875ce9f934cd1fdc21a42f
49344787ceda30b82441b03b22894d75b3bb9742dd731ca82947bf130c5ebc5a
GET /pfe/current/tag.min.js?z=5307590 HTTP/1.1
Host: ibrapush.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: application/javascript
last-modified: Thu, 24 Nov 2022 15:53:54 GMT
etag: W/"637f9392-39be"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
link: <https://my.rtmark.net>; rel=dns-prefetch;, <https://my.rtmark.net>; rel=preconnect
content-encoding: gzip
X-Firefox-Spdy: h2
ibrapush.com/custom
200 OK 39 B IP
File type JSON data\012- , ASCII text
Hash 058b158c2be925f556454ef762d93538
cc6fc563b4b6baee880fdbc7fcfaa134978e33c9
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
POST /custom HTTP/1.1
Host: ibrapush.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://anonymfile.com/
Content-Type: application/json
Origin: https://anonymfile.com
Content-Length: 767
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:03 GMT
content-type: application/json; charset=utf-8
content-length: 39
x-trace-id: 9c4fe880f9205535ea9c5483f6f678ad
access-control-allow-origin: https://anonymfile.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 471 B IP
Hash c910a44bf58b708c25d146fd52adb8e9
374a72c3026ea1fa5defd1e8eb7be2ca7184dfd5
3cf34029e6a112320130d154ac1291e49bcb4a80f0caaf84309456986f0adc77
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 27 Nov 2022 16:54:03 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Fri, 25 Nov 2022 13:33:17 GMT
Expires: Fri, 02 Dec 2022 13:33:16 GMT
Etag: "374a72c3026ea1fa5defd1e8eb7be2ca7184dfd5"
Cache-Control: max-age=419352,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 770c622c8f52b503-OSL
nanouwho.com/9?z=5307589&ng=1&ix=0&pt=0&np=1&gp=-1&bp=-1&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&wy=0&wx=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&sah=1002&drf=&hil=1&ist=0&oaid=f94259f68bbd4d36aa1a19f21bd552f9
204 No Content 0 B URL HTTP/2 nanouwho.com/9?z=5307589&ng=1&ix=0&pt=0&np=1&gp=-1&bp=-1&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&wy=0&wx=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&sah=1002&drf=&hil=1&ist=0&oaid=f94259f68bbd4d36aa1a19f21bd552f9
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
OPTIONS /9?z=5307589&ng=1&ix=0&pt=0&np=1&gp=-1&bp=-1&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&wy=0&wx=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&sah=1002&drf=&hil=1&ist=0&oaid=f94259f68bbd4d36aa1a19f21bd552f9 HTTP/1.1
Host: nanouwho.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://anonymfile.com/
Origin: https://anonymfile.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
server: nginx
date: Sun, 27 Nov 2022 16:54:03 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://anonymfile.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-Sc, CVERSION, VERSION
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, max-age=0
expires: Mon, 26 Jul 1997 05:00:00 GMT
X-Firefox-Spdy: h2
datatechonert.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f
200 OK 12 B URL HTTP/1.1 datatechonert.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash adb4650bfc9d2a73d4dd69583b0ceb14
1ce399d6e936232aaf2192cd7903a279c5015f22
21c1f682de27109caabcca9016511974defcec217c0441fd3f1b50ecdf8247ed
Analyzer Verdict Alert quad9 Sinkholed
POST /log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f HTTP/1.1
Host: datatechonert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 907
Origin: https://anonymfile.com
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Server: nginx/1.19.10
Date: Sun, 27 Nov 2022 16:54:03 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 12
Connection: keep-alive
Access-Control-Allow-Origin: https://anonymfile.com
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Access-Control-Allow-Credentials: true
nanouwho.com/11?rnd=4089403493&z=5307589&b=15868708&var=&rqtdbc=1&rcvdbc=1&btp=7&rb=ttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA==&ruid=2a4a38c8-4c65-459c-9897-f5589c3be13a&ng=1&ix=0&pt=0&np=1&gp=-1&bp=-1&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&wy=0&wx=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&sah=1002&drf=&hil=1&ist=0&ot=80
200 OK 0 B URL HTTP/2 nanouwho.com/11?rnd=4089403493&z=5307589&b=15868708&var=&rqtdbc=1&rcvdbc=1&btp=7&rb=ttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA==&ruid=2a4a38c8-4c65-459c-9897-f5589c3be13a&ng=1&ix=0&pt=0&np=1&gp=-1&bp=-1&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&wy=0&wx=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&sah=1002&drf=&hil=1&ist=0&ot=80
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /11?rnd=4089403493&z=5307589&b=15868708&var=&rqtdbc=1&rcvdbc=1&btp=7&rb=ttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA==&ruid=2a4a38c8-4c65-459c-9897-f5589c3be13a&ng=1&ix=0&pt=0&np=1&gp=-1&bp=-1&nw=1&nb=1&sw=1280&sh=1024&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&wy=0&wx=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&sah=1002&drf=&hil=1&ist=0&ot=80 HTTP/1.1
Host: nanouwho.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://anonymfile.com
Connection: keep-alive
Referer: https://anonymfile.com/
Cookie: scm=1; OAID=f94259f68bbd4d36aa1a19f21bd552f9; oaidts=1669568042
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:03 GMT
content-type: image/jpeg
content-length: 0
access-control-allow-credentials: true
access-control-allow-origin: https://anonymfile.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-Sc, CVERSION, VERSION
x-trace-id: ed65f811ffed0175a92554afc23a3191
access-control-expose-headers: X-Sc
set-cookie: OAID=f94259f68bbd4d36aa1a19f21bd552f9; expires=Mon, 27 Nov 2023 16:54:03 GMT; secure; SameSite=None
oaidts=1669568042; expires=Mon, 27 Nov 2023 16:54:03 GMT; secure; SameSite=None
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, max-age=0
expires: Mon, 26 Jul 1997 05:00:00 GMT
X-Firefox-Spdy: h2
betotodilea.com/500/5307588?excludes=&oaid=f94259f68bbd4d36aa1a19f21bd552f9&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
200 OK 0 B URL HTTP/2 betotodilea.com/500/5307588?excludes=&oaid=f94259f68bbd4d36aa1a19f21bd552f9&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
OPTIONS /500/5307588?excludes=&oaid=f94259f68bbd4d36aa1a19f21bd552f9&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false HTTP/1.1
Host: betotodilea.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Referer: https://anonymfile.com/
Origin: https://anonymfile.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:03 GMT
content-length: 0
allow: GET, OPTIONS
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-origin: https://anonymfile.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-allow-credentials: true
access-control-max-age: 600
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 782b1963e8bd00520376aea92ab3e670
e2d47a6e872b63ea8cc45c514ad603f398d8c5af
6c794b5f447dd11da7d0101e5e71438ddee070e9171a93e0397dfb166727dba6
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6C794B5F447DD11DA7D0101E5E71438DDEE070E9171A93E0397DFB166727DBA6"
Last-Modified: Sun, 27 Nov 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3065
Expires: Sun, 27 Nov 2022 17:45:08 GMT
Date: Sun, 27 Nov 2022 16:54:03 GMT
Connection: keep-alive
interstitial-07.com/contents/s/86/4f/26/1020e094464b23a9837ee388cd/041735649891.jpeg
200 OK 26 kB URL HTTP/2 interstitial-07.com/contents/s/86/4f/26/1020e094464b23a9837ee388cd/041735649891.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 256x256, components 3\012- data
Hash 864f261020e094464b23a9837ee388cd
6cabed2c280af3abf9551c11c7e59f0df3be8c39
426f5e251293449c165b7c0655d7b558c831475714fe8a06c69e25b6310c514f
GET /contents/s/86/4f/26/1020e094464b23a9837ee388cd/041735649891.jpeg HTTP/1.1
Host: interstitial-07.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://interstitial-07.com/?l=b78LZC2DpI7d98p&cd_meta_crid=50535&trkintimp&target_url=https%3A%2F%2Fnanouwho.com%2F12%3Frnd%3D2453440075%26z%3D5307589%26b%3D15868708%26c%3D6361426%26var%3D%26d%3Dhttps%253A%252F%252Fsingelstodate.com%252Fbase.php%253Fc%253D1246%2526key%253Dbd5c0d9cab8b310c30203a37caeb039f%2526zoneid%253D%257Bzoneid%257D%2526cost%253D%257Bcost%257D%2526subid%253D%2524%257BSUBID%257D%2526banner%253D%257Bbannerid%257D%26cln%3D1%26btp%3D7%26rb%3DttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA%3D%3D%26bag%3D6gL6ovyohk0MtEc6YjTuRA%3D%3D%26ruid%3D2a4a38c8-4c65-459c-9897-f5589c3be13a%26ng%3D1%26ix%3D0%26pt%3D0%26np%3D1%26gp%3D-1%26bp%3D-1%26nw%3D1%26nb%3D1%26sw%3D1280%26sh%3D1024%26pl%3Dhttps%253A%252F%252Fanonymfile.com%252FmkJOo%252Frbxphishing.exe%26wy%3D0%26wx%3D0%26ww%3D1280%26wh%3D1024%26cw%3D1280%26wiw%3D1280%26wih%3D939%26wfc%3D0%26sah%3D1002%26drf%3D%26hil%3D1%26ist%3D0%26tbc%3D0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:03 GMT
content-type: image/jpeg
content-length: 26149
last-modified: Tue, 22 Mar 2022 17:46:52 GMT
vary: Accept-Encoding
etag: "623a0b8c-6625"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
accept-ranges: bytes
X-Firefox-Spdy: h2
offerimage.com/www/images/af998b3568313b8e420e478b440512f6.jpeg
200 OK 14 kB URL HTTP/2 offerimage.com/www/images/af998b3568313b8e420e478b440512f6.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 192x192, components 3\012- data
Hash af998b3568313b8e420e478b440512f6
14a705bb3342842b682668f6b25ae049a242aa4c
f3f97e78bc45c5e8d1dcd55572b3164951fb6fa93e983963fb1873e20c6da093
GET /www/images/af998b3568313b8e420e478b440512f6.jpeg HTTP/1.1
Host: offerimage.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 27 Nov 2022 16:54:03 GMT
content-type: image/jpeg
content-length: 14274
cache-control: max-age=86400
cf-bgj: h2pri
etag: "6381073b-37c2"
expires: Mon, 28 Nov 2022 11:11:27 GMT
last-modified: Fri, 25 Nov 2022 18:19:39 GMT
timing-allow-origin: *
cf-cache-status: HIT
age: 20556
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 770c622ffe5fb527-OSL
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 9a3614a6a98d9ad59cfe0d08fc734093
59f1faa0d921199285c4c45a3479a463aed3e19b
e75fbdfbcd6907f9c1592c434abe6b3c1a8e62595365063d7c2887dbdcb4326a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E75FBDFBCD6907F9C1592C434ABE6B3C1A8E62595365063D7C2887DBDCB4326A"
Last-Modified: Sat, 26 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7065
Expires: Sun, 27 Nov 2022 18:51:48 GMT
Date: Sun, 27 Nov 2022 16:54:03 GMT
Connection: keep-alive
interstitial-07.com/contents/s/37/85/42/c521c27ea0d1d855cc0c2a879a/0521540239847.jpeg
200 OK 52 kB URL HTTP/2 interstitial-07.com/contents/s/37/85/42/c521c27ea0d1d855cc0c2a879a/0521540239847.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 492x328, components 3\012- data
Hash 378542c521c27ea0d1d855cc0c2a879a
259461a1217b6e1f6e43a339f0d18f43254eb14e
3a2724ee17b3a347dd42b0c2b0900945e0de137299faa1e3e66c46360f8694ad
GET /contents/s/37/85/42/c521c27ea0d1d855cc0c2a879a/0521540239847.jpeg HTTP/1.1
Host: interstitial-07.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://interstitial-07.com/?l=b78LZC2DpI7d98p&cd_meta_crid=50535&trkintimp&target_url=https%3A%2F%2Fnanouwho.com%2F12%3Frnd%3D2453440075%26z%3D5307589%26b%3D15868708%26c%3D6361426%26var%3D%26d%3Dhttps%253A%252F%252Fsingelstodate.com%252Fbase.php%253Fc%253D1246%2526key%253Dbd5c0d9cab8b310c30203a37caeb039f%2526zoneid%253D%257Bzoneid%257D%2526cost%253D%257Bcost%257D%2526subid%253D%2524%257BSUBID%257D%2526banner%253D%257Bbannerid%257D%26cln%3D1%26btp%3D7%26rb%3DttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA%3D%3D%26bag%3D6gL6ovyohk0MtEc6YjTuRA%3D%3D%26ruid%3D2a4a38c8-4c65-459c-9897-f5589c3be13a%26ng%3D1%26ix%3D0%26pt%3D0%26np%3D1%26gp%3D-1%26bp%3D-1%26nw%3D1%26nb%3D1%26sw%3D1280%26sh%3D1024%26pl%3Dhttps%253A%252F%252Fanonymfile.com%252FmkJOo%252Frbxphishing.exe%26wy%3D0%26wx%3D0%26ww%3D1280%26wh%3D1024%26cw%3D1280%26wiw%3D1280%26wih%3D939%26wfc%3D0%26sah%3D1002%26drf%3D%26hil%3D1%26ist%3D0%26tbc%3D0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:03 GMT
content-type: image/jpeg
content-length: 52046
last-modified: Wed, 16 Mar 2022 03:43:15 GMT
vary: Accept-Encoding
etag: "62315cd3-cb4e"
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS, HEAD
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range
accept-ranges: bytes
X-Firefox-Spdy: h2
unphionetor.com/vctx?t=72747
204 No Content 0 B URL HTTP/2 unphionetor.com/vctx?t=72747
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /vctx?t=72747 HTTP/1.1
Host: unphionetor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://interstitial-07.com
Connection: keep-alive
Referer: https://interstitial-07.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
server: nginx
date: Sun, 27 Nov 2022 16:54:03 GMT
access-control-allow-origin: https://interstitial-07.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
x-trace-id: 54667aae92b90708874ca69e368face4
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
unphionetor.com/vbl?t=72747&bid=undefined&aid=undefined
204 No Content 0 B URL HTTP/2 unphionetor.com/vbl?t=72747&bid=undefined&aid=undefined
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
POST /vbl?t=72747&bid=undefined&aid=undefined HTTP/1.1
Host: unphionetor.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://interstitial-07.com
Connection: keep-alive
Referer: https://interstitial-07.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers
HTTP/2 204 No Content
server: nginx
date: Sun, 27 Nov 2022 16:54:03 GMT
access-control-allow-origin: https://interstitial-07.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
x-trace-id: 1d6c84877507f85ca8ae5f550488d405
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aebda342a81ad83f60d2523f54ccda67
e590d9326e4a283e0929a8ffccb13cc4308af0e6
bd123fe3fce93216e2635f9dbc356f081b7599784fb6b67984032f11d82bc7cb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BD123FE3FCE93216E2635F9DBC356F081B7599784FB6B67984032F11D82BC7CB"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14590
Expires: Sun, 27 Nov 2022 20:57:13 GMT
Date: Sun, 27 Nov 2022 16:54:03 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aebda342a81ad83f60d2523f54ccda67
e590d9326e4a283e0929a8ffccb13cc4308af0e6
bd123fe3fce93216e2635f9dbc356f081b7599784fb6b67984032f11d82bc7cb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BD123FE3FCE93216E2635F9DBC356F081B7599784FB6B67984032F11D82BC7CB"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14590
Expires: Sun, 27 Nov 2022 20:57:13 GMT
Date: Sun, 27 Nov 2022 16:54:03 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash aebda342a81ad83f60d2523f54ccda67
e590d9326e4a283e0929a8ffccb13cc4308af0e6
bd123fe3fce93216e2635f9dbc356f081b7599784fb6b67984032f11d82bc7cb
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BD123FE3FCE93216E2635F9DBC356F081B7599784FB6B67984032F11D82BC7CB"
Last-Modified: Sat, 26 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14590
Expires: Sun, 27 Nov 2022 20:57:13 GMT
Date: Sun, 27 Nov 2022 16:54:03 GMT
Connection: keep-alive
betotodilea.com/400/5307588
200 OK 32 kB URL HTTP/2 betotodilea.com/400/5307588
IP
Hash 5ca38cbc831d7fcb21b723c2f4132aec
d43744eec54765706571e1268775ad8269769b1d
9e2bad4953db82a4e20b3685f977de6012001e01aa842f1261d72d7abf79ca6e
Analyzer Verdict Alert quad9 Sinkholed
GET /400/5307588 HTTP/1.1
Host: betotodilea.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: application/javascript
x-trace-id: de5bbfcd8a101297b687c5115388ea2d
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: *
access-control-expose-headers: Link
access-control-allow-credentials: true
set-cookie: OAID=8cb2d6019ad240f1bd47939c8ba4712a; expires=Mon, 27 Nov 2023 16:54:02 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdee4f5d4-5a5e-4a39-9681-50795cecc0f4.jpeg
200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdee4f5d4-5a5e-4a39-9681-50795cecc0f4.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2cd887044e91d7ed0f1a8d7119ff7dd0
ae8aa4ce6ddaccba771fe65446926b60fc5628da
bad283c15531000b7a8c126d442154b64a880cc26196a46cbd2e6266a526db67
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdee4f5d4-5a5e-4a39-9681-50795cecc0f4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10199
x-amzn-requestid: baee3bbe-7ded-425a-ae39-fccfc8169217
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cOo4iF1VIAMF09g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63828836-5522727b2f09b27e63b23270;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 21:42:14 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: K2eKLQhrsCdd4ASsfEibRuZAYW4CpPTlO3fZs7xdoKrw1HBxfTGkEA==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 21:42:14 GMT
etag: "ae8aa4ce6ddaccba771fe65446926b60fc5628da"
content-type: image/jpeg
age: 69109
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
betotodilea.com/500/5307588?excludes=&oaid=f94259f68bbd4d36aa1a19f21bd552f9&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
200 OK 6.3 kB URL HTTP/2 betotodilea.com/500/5307588?excludes=&oaid=f94259f68bbd4d36aa1a19f21bd552f9&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
IP
Hash 72e245235af19eef27f85086e0aee6fd
9598a304815d7b02e50dc878d5afb3dcf1f56acd
8a86d94628eb37f110f1d354ee27afb3d30a6c1393cd793c79a2b0015a4f9080
Analyzer Verdict Alert quad9 Sinkholed
GET /500/5307588?excludes=&oaid=f94259f68bbd4d36aa1a19f21bd552f9&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=0&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false HTTP/1.1
Host: betotodilea.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Origin: https://anonymfile.com
Connection: keep-alive
Referer: https://anonymfile.com/
Cookie: OAID=8cb2d6019ad240f1bd47939c8ba4712a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:03 GMT
content-type: application/javascript
x-trace-id: 0418b295e06e31d41e3522aabc78b8e6
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: https://anonymfile.com
access-control-expose-headers: Link
access-control-allow-credentials: true
set-cookie: OAID=f94259f68bbd4d36aa1a19f21bd552f9; expires=Mon, 27 Nov 2023 16:54:03 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fba57ea10-c30b-4188-bb72-b589f3564094.jpeg
200 OK 8.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fba57ea10-c30b-4188-bb72-b589f3564094.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 741ddfb19764ac9a77509e7e87cfbfb2
308c08784ce4a0757cbd112807555b83e17a1d56
e9271a76da94d8b655860c3b00d111396c5d3a227fd2f19e0ef400fd5e84d87e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fba57ea10-c30b-4188-bb72-b589f3564094.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8817
x-amzn-requestid: 33d3ca17-7878-4897-a634-5f626a64e820
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cJ40OEOqIAMFaOg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6380a1b4-040288d571fc10b96d893fa4;Sampled=0
x-amzn-remapped-date: Fri, 25 Nov 2022 11:06:28 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: f_U8KSYET6kaKAPbEV7sHW0tO6JGijsqUvghniwzFCRd2YGQjVlFoA==
via: 1.1 f313d3df80c4dab8f5399614116801cc.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Sun, 27 Nov 2022 10:16:35 GMT
age: 23848
etag: "308c08784ce4a0757cbd112807555b83e17a1d56"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F34752db1-0be8-4784-9fa0-41e828e40e06.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F34752db1-0be8-4784-9fa0-41e828e40e06.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 1db6041a0bdb2319ae85afcc30caaeec
3b0ec6a7188dadf986f72fda8110296d9abd6f35
05f1f9b7834e7268dc34e3233434217f58cb68ee43a403cd08d0bb0ab4f37815
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F34752db1-0be8-4784-9fa0-41e828e40e06.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13049
x-amzn-requestid: 2755f206-af23-4597-b4b9-7dae5001d6be
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cBsvpHDJoAMFhFQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637d5b30-600008f573bd7e0024585eb1;Sampled=0
x-amzn-remapped-date: Tue, 22 Nov 2022 23:28:48 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: y0ofyT6UcPjB8mfRR1VMjHSTW64Qb_EQ0rrjsOdbby1CG-xMIFJMPw==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 21:49:19 GMT
age: 68684
etag: "3b0ec6a7188dadf986f72fda8110296d9abd6f35"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa57bc6cf-beaa-443b-9756-cf26e4fe3767.jpeg
200 OK 7.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa57bc6cf-beaa-443b-9756-cf26e4fe3767.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2212cf75f99dc67fd45db47f7101d754
4b4a8c8e8aeccfff25d2748720dcef8fed287126
7b2d2e302faba8f273b51031fa48b444cb7839733b90e8c9d077ca63637320d8
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa57bc6cf-beaa-443b-9756-cf26e4fe3767.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6954
x-amzn-requestid: 94a02687-72f2-4796-a7ea-d3f28b412566
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: b1jHpGBVIAMFsSg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63787efd-22666b18283ae59b1348bf47;Sampled=0
x-amzn-remapped-date: Sat, 19 Nov 2022 07:00:13 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: feZayJeKq9jWHQ-rjutNr6buIjLVeIdY0A_ZeGo6NKgoQ6BBT3XQaw==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 0906d4887f6625f4a4467d8d4fd268d2.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 22:22:57 GMT
age: 66666
etag: "4b4a8c8e8aeccfff25d2748720dcef8fed287126"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
anonymfile.com/sw.js
404 Not Found 17 kB IP
ASN #24940 Hetzner Online GmbH
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (4320)
Hash cde767836d1fbbc605301218787c8099
c7866af4ea519b7fde69b37c15fa23319004f11a
f4b56fd25de2f01d8ff9293de13c970ba65cadf0a2e9283bc6e1669c2bc6c669
GET /sw.js HTTP/1.1
Host: anonymfile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://anonymfile.com/mkJOo/rbxphishing.exe
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ik5Fd3hBR3JOQ3lIcS9uR2NYMU5QS3c9PSIsInZhbHVlIjoibGw4UDRSWHVHWnNUZG5RWURpUk96NXhOQVJQR2dwU21PWjNEbTZWS3QvRzA4UjF5ei80Rmt5dU9NenZYczFlMkw3NkhhVFNsZnFySHh6cTFGWDFFcG9SWG5HVGxYOU4xOFFtbktzL2g1N2RtZ21sMllTbEZDZGdOK0IrQW90SWgiLCJtYWMiOiJjOTAxODFhYzcxYTYyNmU3MGIxMDYwNjI2NWJkMTY5YjUxNjk3Yzc1YzhiMWNiZTQ4OGQ4M2YxNjdmZDU1NzkwIiwidGFnIjoiIn0%3D; anonymfile_session=eyJpdiI6Ik5Bc2NZb3hkK3ZrcjJtTnJkRS9Zc1E9PSIsInZhbHVlIjoidmlWTWlYNDk2V2RTdUpUR2xGR1l5OENEdkcvL3RMSlZHbUhudFcrVFUxR3hqZkdmM0Z1WWZvQ2ZMM0FCQ2dnZWE4UGlxTmhxQWREaTVnalhYZTUrbDFMUTRQcmlrdmZyb0tCZFQwUVkzUXZScXZJcGlidFkzd0hrVERyVUpYS2siLCJtYWMiOiI4YmViZDE0M2JiMmI2MmVkYjYzZDAxN2M4ZjlhNDY1ZTUyN2FkODM0ZGM1MmIzMzZlMjQxMWMxM2VjNzY3MmQ1IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
date: Sun, 27 Nov 2022 16:54:03 GMT
x-page-speed: 1.13.35.2-0
cache-control: max-age=0, no-cache
content-encoding: br
X-Firefox-Spdy: h2
nanouwho.com/15?rnd=786516818&z=5307589&var=&rb=ttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA==&ruid=2a4a38c8-4c65-459c-9897-f5589c3be13a&uci=%7B%22path%22%3A%7B%22count%22%3A0%2C%22totalLength%22%3A0%2C%22pathHistogram%22%3A%7B%224%22%3A0%2C%228%22%3A0%2C%2216%22%3A0%2C%2232%22%3A0%2C%2264%22%3A0%2C%22128%22%3A0%2C%22256%22%3A0%2C%22512%22%3A0%2C%221024%22%3A0%7D%7D%2C%22durationOnCreate%22%3A1.089%2C%22location%22%3A%22https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe%22%2C%22isSelenium%22%3Afalse%2C%22isPhantom%22%3Afalse%2C%22isTouch%22%3Afalse%2C%22pluginCount%22%3A0%2C%22wdov%22%3A0%2C%22isIONS%22%3Atrue%7D
204 No Content 0 B URL HTTP/2 nanouwho.com/15?rnd=786516818&z=5307589&var=&rb=ttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA==&ruid=2a4a38c8-4c65-459c-9897-f5589c3be13a&uci=%7B%22path%22%3A%7B%22count%22%3A0%2C%22totalLength%22%3A0%2C%22pathHistogram%22%3A%7B%224%22%3A0%2C%228%22%3A0%2C%2216%22%3A0%2C%2232%22%3A0%2C%2264%22%3A0%2C%22128%22%3A0%2C%22256%22%3A0%2C%22512%22%3A0%2C%221024%22%3A0%7D%7D%2C%22durationOnCreate%22%3A1.089%2C%22location%22%3A%22https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe%22%2C%22isSelenium%22%3Afalse%2C%22isPhantom%22%3Afalse%2C%22isTouch%22%3Afalse%2C%22pluginCount%22%3A0%2C%22wdov%22%3A0%2C%22isIONS%22%3Atrue%7D
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /15?rnd=786516818&z=5307589&var=&rb=ttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA==&ruid=2a4a38c8-4c65-459c-9897-f5589c3be13a&uci=%7B%22path%22%3A%7B%22count%22%3A0%2C%22totalLength%22%3A0%2C%22pathHistogram%22%3A%7B%224%22%3A0%2C%228%22%3A0%2C%2216%22%3A0%2C%2232%22%3A0%2C%2264%22%3A0%2C%22128%22%3A0%2C%22256%22%3A0%2C%22512%22%3A0%2C%221024%22%3A0%7D%7D%2C%22durationOnCreate%22%3A1.089%2C%22location%22%3A%22https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe%22%2C%22isSelenium%22%3Afalse%2C%22isPhantom%22%3Afalse%2C%22isTouch%22%3Afalse%2C%22pluginCount%22%3A0%2C%22wdov%22%3A0%2C%22isIONS%22%3Atrue%7D HTTP/1.1
Host: nanouwho.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://anonymfile.com
Connection: keep-alive
Referer: https://anonymfile.com/
Cookie: scm=1; OAID=f94259f68bbd4d36aa1a19f21bd552f9; oaidts=1669568042
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
server: nginx
date: Sun, 27 Nov 2022 16:54:04 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://anonymfile.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-Sc, CVERSION, VERSION
x-trace-id: 6dee1a50b9572475f60389cdcd073f18
access-control-expose-headers: X-Sc
set-cookie: OAID=f94259f68bbd4d36aa1a19f21bd552f9; expires=Mon, 27 Nov 2023 16:54:04 GMT; secure; SameSite=None
oaidts=1669568042; expires=Mon, 27 Nov 2023 16:54:04 GMT; secure; SameSite=None
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, max-age=0
expires: Mon, 26 Jul 1997 05:00:00 GMT
X-Firefox-Spdy: h2
nanouwho.com/15?rnd=786516818&z=5307589&var=&rb=ttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA==&ruid=2a4a38c8-4c65-459c-9897-f5589c3be13a&uci=%7B%22path%22%3A%7B%22count%22%3A0%2C%22totalLength%22%3A0%2C%22pathHistogram%22%3A%7B%224%22%3A0%2C%228%22%3A0%2C%2216%22%3A0%2C%2232%22%3A0%2C%2264%22%3A0%2C%22128%22%3A0%2C%22256%22%3A0%2C%22512%22%3A0%2C%221024%22%3A0%7D%7D%2C%22durationOnCreate%22%3A3.091%2C%22location%22%3A%22https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe%22%2C%22isSelenium%22%3Afalse%2C%22isPhantom%22%3Afalse%2C%22isTouch%22%3Afalse%2C%22pluginCount%22%3A0%2C%22wdov%22%3A0%2C%22isIONS%22%3Atrue%7D
204 No Content 0 B URL HTTP/2 nanouwho.com/15?rnd=786516818&z=5307589&var=&rb=ttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA==&ruid=2a4a38c8-4c65-459c-9897-f5589c3be13a&uci=%7B%22path%22%3A%7B%22count%22%3A0%2C%22totalLength%22%3A0%2C%22pathHistogram%22%3A%7B%224%22%3A0%2C%228%22%3A0%2C%2216%22%3A0%2C%2232%22%3A0%2C%2264%22%3A0%2C%22128%22%3A0%2C%22256%22%3A0%2C%22512%22%3A0%2C%221024%22%3A0%7D%7D%2C%22durationOnCreate%22%3A3.091%2C%22location%22%3A%22https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe%22%2C%22isSelenium%22%3Afalse%2C%22isPhantom%22%3Afalse%2C%22isTouch%22%3Afalse%2C%22pluginCount%22%3A0%2C%22wdov%22%3A0%2C%22isIONS%22%3Atrue%7D
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /15?rnd=786516818&z=5307589&var=&rb=ttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA==&ruid=2a4a38c8-4c65-459c-9897-f5589c3be13a&uci=%7B%22path%22%3A%7B%22count%22%3A0%2C%22totalLength%22%3A0%2C%22pathHistogram%22%3A%7B%224%22%3A0%2C%228%22%3A0%2C%2216%22%3A0%2C%2232%22%3A0%2C%2264%22%3A0%2C%22128%22%3A0%2C%22256%22%3A0%2C%22512%22%3A0%2C%221024%22%3A0%7D%7D%2C%22durationOnCreate%22%3A3.091%2C%22location%22%3A%22https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe%22%2C%22isSelenium%22%3Afalse%2C%22isPhantom%22%3Afalse%2C%22isTouch%22%3Afalse%2C%22pluginCount%22%3A0%2C%22wdov%22%3A0%2C%22isIONS%22%3Atrue%7D HTTP/1.1
Host: nanouwho.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://anonymfile.com
Connection: keep-alive
Referer: https://anonymfile.com/
Cookie: scm=1; OAID=f94259f68bbd4d36aa1a19f21bd552f9; oaidts=1669568042
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
server: nginx
date: Sun, 27 Nov 2022 16:54:06 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://anonymfile.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-Sc, CVERSION, VERSION
x-trace-id: 1ea11a07287516de66779bccac81bf9c
access-control-expose-headers: X-Sc
set-cookie: OAID=f94259f68bbd4d36aa1a19f21bd552f9; expires=Mon, 27 Nov 2023 16:54:06 GMT; secure; SameSite=None
oaidts=1669568042; expires=Mon, 27 Nov 2023 16:54:06 GMT; secure; SameSite=None
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, max-age=0
expires: Mon, 26 Jul 1997 05:00:00 GMT
X-Firefox-Spdy: h2
betotodilea.com/impression/wJ13pL1EQVbsP86WASp6qYKFaC-ifEGMYsbKdBYX8ZcpLtV0pR3DKY54uqlVQtOLTlB-OtgoQFJ-ojPIqVvecbxw57uasuTyE7GL-ysXNv6Xd2Yl3sfzMZYec9pcG4LZMnI5gRq9N1QpCq2N0yefWOBDvayf5bwxsoOH4RM3hiGIFQS1qRHwHJcm3H0LUVgdaEFR8fniIuTx0gHsdiuAb1xhZ8em9gFJoq-TLvK1SssRFIwcOW1JTmwNpsx_X8fMd-HXs-UJOo1fIvkll0ZJjEaTQkyfeGAtHFrmE4Unjw84rmk9FYuZF5bcDXx064xye_ZIWclKnXJ3AhqldDszdbXyUPiz_rf5KA9jP7KuETXVYyEZqCPxowhFlW6gMjpPUaf908zoEkN8piBwGHVdw2NJc1EOZW1IuyNrac4d3urLGEsUrC8m7kXh6tB2xkqKPuoga6hmv92Pa5zWHJDmYhHYZa1jpAbNaMbvhj9AFh1IG9pI003JzkHHnmkUw7eGO65C7phMjhjZJsNgc6NPqyz1m4QErTgebRgz-DQ-uQ5gjysaX0u-D1-vGMlqhJrpj85U3F5x0BSLJk6vFK6x3sub3b5uYCbWqNauJLyHcJbTHiJj0TknGBaHgKrRepXmL7isIMfJeBAtnLeWimKH6XYKnzztYjWl7u1Ahd5zzoYEuQZQXzhqZfTTfVlkbD-VDQKg-USueDE=?_z=5307588&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=1&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
200 OK 43 B URL HTTP/2 betotodilea.com/impression/wJ13pL1EQVbsP86WASp6qYKFaC-ifEGMYsbKdBYX8ZcpLtV0pR3DKY54uqlVQtOLTlB-OtgoQFJ-ojPIqVvecbxw57uasuTyE7GL-ysXNv6Xd2Yl3sfzMZYec9pcG4LZMnI5gRq9N1QpCq2N0yefWOBDvayf5bwxsoOH4RM3hiGIFQS1qRHwHJcm3H0LUVgdaEFR8fniIuTx0gHsdiuAb1xhZ8em9gFJoq-TLvK1SssRFIwcOW1JTmwNpsx_X8fMd-HXs-UJOo1fIvkll0ZJjEaTQkyfeGAtHFrmE4Unjw84rmk9FYuZF5bcDXx064xye_ZIWclKnXJ3AhqldDszdbXyUPiz_rf5KA9jP7KuETXVYyEZqCPxowhFlW6gMjpPUaf908zoEkN8piBwGHVdw2NJc1EOZW1IuyNrac4d3urLGEsUrC8m7kXh6tB2xkqKPuoga6hmv92Pa5zWHJDmYhHYZa1jpAbNaMbvhj9AFh1IG9pI003JzkHHnmkUw7eGO65C7phMjhjZJsNgc6NPqyz1m4QErTgebRgz-DQ-uQ5gjysaX0u-D1-vGMlqhJrpj85U3F5x0BSLJk6vFK6x3sub3b5uYCbWqNauJLyHcJbTHiJj0TknGBaHgKrRepXmL7isIMfJeBAtnLeWimKH6XYKnzztYjWl7u1Ahd5zzoYEuQZQXzhqZfTTfVlkbD-VDQKg-USueDE=?_z=5307588&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=1&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
IP
File type GIF image data, version 89a, 1 x 1\012- data
Hash b4491705564909da7f9eaf749dbbfbb1
279315d507855c6a4351e1e2c2f39dd9cd2fccd8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Analyzer Verdict Alert quad9 Sinkholed
GET /impression/wJ13pL1EQVbsP86WASp6qYKFaC-ifEGMYsbKdBYX8ZcpLtV0pR3DKY54uqlVQtOLTlB-OtgoQFJ-ojPIqVvecbxw57uasuTyE7GL-ysXNv6Xd2Yl3sfzMZYec9pcG4LZMnI5gRq9N1QpCq2N0yefWOBDvayf5bwxsoOH4RM3hiGIFQS1qRHwHJcm3H0LUVgdaEFR8fniIuTx0gHsdiuAb1xhZ8em9gFJoq-TLvK1SssRFIwcOW1JTmwNpsx_X8fMd-HXs-UJOo1fIvkll0ZJjEaTQkyfeGAtHFrmE4Unjw84rmk9FYuZF5bcDXx064xye_ZIWclKnXJ3AhqldDszdbXyUPiz_rf5KA9jP7KuETXVYyEZqCPxowhFlW6gMjpPUaf908zoEkN8piBwGHVdw2NJc1EOZW1IuyNrac4d3urLGEsUrC8m7kXh6tB2xkqKPuoga6hmv92Pa5zWHJDmYhHYZa1jpAbNaMbvhj9AFh1IG9pI003JzkHHnmkUw7eGO65C7phMjhjZJsNgc6NPqyz1m4QErTgebRgz-DQ-uQ5gjysaX0u-D1-vGMlqhJrpj85U3F5x0BSLJk6vFK6x3sub3b5uYCbWqNauJLyHcJbTHiJj0TknGBaHgKrRepXmL7isIMfJeBAtnLeWimKH6XYKnzztYjWl7u1Ahd5zzoYEuQZQXzhqZfTTfVlkbD-VDQKg-USueDE=?_z=5307588&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=1&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false HTTP/1.1
Host: betotodilea.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Cookie: OAID=f94259f68bbd4d36aa1a19f21bd552f9
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:08 GMT
content-type: image/gif
content-length: 43
x-trace-id: e3a82987c5c67e610c21acec48bf8f81
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: *
access-control-expose-headers: Link
access-control-allow-credentials: true
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
betotodilea.com/500/5307588?excludes=15867746&oaid=f94259f68bbd4d36aa1a19f21bd552f9&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=2&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
200 OK 0 B URL HTTP/2 betotodilea.com/500/5307588?excludes=15867746&oaid=f94259f68bbd4d36aa1a19f21bd552f9&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=2&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
OPTIONS /500/5307588?excludes=15867746&oaid=f94259f68bbd4d36aa1a19f21bd552f9&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=2&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false HTTP/1.1
Host: betotodilea.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Referer: https://anonymfile.com/
Origin: https://anonymfile.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:08 GMT
content-length: 0
allow: GET, OPTIONS
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-origin: https://anonymfile.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
access-control-allow-credentials: true
access-control-max-age: 600
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *
X-Firefox-Spdy: h2
betotodilea.com/500/5307588?excludes=15867746&oaid=f94259f68bbd4d36aa1a19f21bd552f9&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=2&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
200 OK 38 kB URL HTTP/2 betotodilea.com/500/5307588?excludes=15867746&oaid=f94259f68bbd4d36aa1a19f21bd552f9&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=2&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false
IP
Hash 87141545a92da88c194363745f0ec98f
6e3590624dbded4ba32213b8ec55e6bafe5550f8
d3a6213eacd6cde6ecc29140751bc0f066ef864ea70349667726f40a97edf082
Analyzer Verdict Alert quad9 Sinkholed
GET /500/5307588?excludes=15867746&oaid=f94259f68bbd4d36aa1a19f21bd552f9&fs=0&cf=0&sw=1280&sh=1024&sah=1002&wx=0&wy=0&ww=1280&wh=1024&cw=1280&wiw=1280&wih=939&wfc=2&pl=https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe&drf=&np=0&pt=0&nb=1&ng=1&ix=0&nw=1&tb=false HTTP/1.1
Host: betotodilea.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Origin: https://anonymfile.com
Connection: keep-alive
Referer: https://anonymfile.com/
Cookie: OAID=f94259f68bbd4d36aa1a19f21bd552f9
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:08 GMT
content-type: application/javascript
x-trace-id: d72616c2d164b2f32adebc5b0a2c3854
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: https://anonymfile.com
access-control-expose-headers: Link
access-control-allow-credentials: true
set-cookie: OAID=f94259f68bbd4d36aa1a19f21bd552f9; expires=Mon, 27 Nov 2023 16:54:08 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
nanouwho.com/15?rnd=786516818&z=5307589&var=&rb=ttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA==&ruid=2a4a38c8-4c65-459c-9897-f5589c3be13a&uci=%7B%22path%22%3A%7B%22count%22%3A0%2C%22totalLength%22%3A0%2C%22pathHistogram%22%3A%7B%224%22%3A0%2C%228%22%3A0%2C%2216%22%3A0%2C%2232%22%3A0%2C%2264%22%3A0%2C%22128%22%3A0%2C%22256%22%3A0%2C%22512%22%3A0%2C%221024%22%3A0%7D%7D%2C%22durationOnCreate%22%3A7.092%2C%22location%22%3A%22https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe%22%2C%22isSelenium%22%3Afalse%2C%22isPhantom%22%3Afalse%2C%22isTouch%22%3Afalse%2C%22pluginCount%22%3A0%2C%22wdov%22%3A0%2C%22isIONS%22%3Atrue%7D
204 No Content 0 B URL HTTP/2 nanouwho.com/15?rnd=786516818&z=5307589&var=&rb=ttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA==&ruid=2a4a38c8-4c65-459c-9897-f5589c3be13a&uci=%7B%22path%22%3A%7B%22count%22%3A0%2C%22totalLength%22%3A0%2C%22pathHistogram%22%3A%7B%224%22%3A0%2C%228%22%3A0%2C%2216%22%3A0%2C%2232%22%3A0%2C%2264%22%3A0%2C%22128%22%3A0%2C%22256%22%3A0%2C%22512%22%3A0%2C%221024%22%3A0%7D%7D%2C%22durationOnCreate%22%3A7.092%2C%22location%22%3A%22https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe%22%2C%22isSelenium%22%3Afalse%2C%22isPhantom%22%3Afalse%2C%22isTouch%22%3Afalse%2C%22pluginCount%22%3A0%2C%22wdov%22%3A0%2C%22isIONS%22%3Atrue%7D
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 Sinkholed
GET /15?rnd=786516818&z=5307589&var=&rb=ttP6g7SB-IMVdCXg4FqWhwrMpqFgnYkMjLodH6NhF9S9oD_-ApnvO0-3AJKtvU-DHPszB59LxZPbxH6yWVifkc3ZXXawIDFFguE8eCj4yCBowjo0916JJAAvznhTSafMae3Ea5tUKzxnPldMz1A-0ySRiTsPZV_UusPbyYjDgs3fZu2EogCjc2bLjL2xwc4URzXstNg285xwqbOv8nKOiUWVvaK_TSTmt7LzA2LYW2jlSYPI_bRtFK9Vq-FOE6tpZLA_-uNfOR153cSBfuAtdQGPcrPkHTxjVvBwc_t4Sfd0VH0XLCiBYXtoSEIfbolmQnve7VDzrixjYqnL73ZuiDGnbPycbet0YEoqknEucaTER2M7ClOoKEO6-i9KKBZY9d23W7ZAylT6MRF9lsAIlX7cW5aP7-MPJE1l-GtKy-pz3gh0JZzL9YuCYi8hnHvuiUIBp7ChEpUuxiGzgOTBDMPl-NGTX5OMJUeH-ZqS9MUHv5v9IbW5FQ5X8kI67vAZzdWiYL6_L4i47Es4bdHjc2NWYljv1JpZiQxvbC5qbi-G4-SdhQlPBY4exbHN_eCc_par3unl7hR1H7Dq8uO3_Rqrnern5Mfp016umyHVOpZ4L2Q6AzKr8tm-g7NjySrspfFiQinChZrC_BoP1EvtZA==&ruid=2a4a38c8-4c65-459c-9897-f5589c3be13a&uci=%7B%22path%22%3A%7B%22count%22%3A0%2C%22totalLength%22%3A0%2C%22pathHistogram%22%3A%7B%224%22%3A0%2C%228%22%3A0%2C%2216%22%3A0%2C%2232%22%3A0%2C%2264%22%3A0%2C%22128%22%3A0%2C%22256%22%3A0%2C%22512%22%3A0%2C%221024%22%3A0%7D%7D%2C%22durationOnCreate%22%3A7.092%2C%22location%22%3A%22https%3A%2F%2Fanonymfile.com%2FmkJOo%2Frbxphishing.exe%22%2C%22isSelenium%22%3Afalse%2C%22isPhantom%22%3Afalse%2C%22isTouch%22%3Afalse%2C%22pluginCount%22%3A0%2C%22wdov%22%3A0%2C%22isIONS%22%3Atrue%7D HTTP/1.1
Host: nanouwho.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://anonymfile.com
Connection: keep-alive
Referer: https://anonymfile.com/
Cookie: scm=1; OAID=f94259f68bbd4d36aa1a19f21bd552f9; oaidts=1669568042
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 204 No Content
server: nginx
date: Sun, 27 Nov 2022 16:54:10 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://anonymfile.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-Sc, CVERSION, VERSION
x-trace-id: b693ec0ab2e2082aa2cfae170456bd70
access-control-expose-headers: X-Sc
set-cookie: OAID=f94259f68bbd4d36aa1a19f21bd552f9; expires=Mon, 27 Nov 2023 16:54:10 GMT; secure; SameSite=None
oaidts=1669568042; expires=Mon, 27 Nov 2023 16:54:10 GMT; secure; SameSite=None
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, max-age=0
expires: Mon, 26 Jul 1997 05:00:00 GMT
X-Firefox-Spdy: h2
unpkg.com/filepond-plugin-file-validate-type/dist/filepond-plugin-file-validate-type.js
302 Found 0 B URL HTTP/2 unpkg.com/filepond-plugin-file-validate-type/dist/filepond-plugin-file-validate-type.js
IP
GET /filepond-plugin-file-validate-type/dist/filepond-plugin-file-validate-type.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=600, max-age=60
location: /filepond-plugin-file-validate-type@1.2.8/dist/filepond-plugin-file-validate-type.js
vary: Accept, Accept-Encoding
via: 1.1 fly.io
fly-request-id: 01GJWZNES4HRWTWWWR95YKMCQ0-ams
cf-cache-status: HIT
age: 515
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 770c6227bc330afe-OSL
X-Firefox-Spdy: h2
anonymfile.com/pagespeed_static/js_defer.I4cHjq6EEP.js
200 OK 0 B URL HTTP/2 anonymfile.com/pagespeed_static/js_defer.I4cHjq6EEP.js
IP
ASN #24940 Hetzner Online GmbH
GET /pagespeed_static/js_defer.I4cHjq6EEP.js HTTP/1.1
Host: anonymfile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/mkJOo/rbxphishing.exe
Cookie: XSRF-TOKEN=eyJpdiI6Ik5Fd3hBR3JOQ3lIcS9uR2NYMU5QS3c9PSIsInZhbHVlIjoibGw4UDRSWHVHWnNUZG5RWURpUk96NXhOQVJQR2dwU21PWjNEbTZWS3QvRzA4UjF5ei80Rmt5dU9NenZYczFlMkw3NkhhVFNsZnFySHh6cTFGWDFFcG9SWG5HVGxYOU4xOFFtbktzL2g1N2RtZ21sMllTbEZDZGdOK0IrQW90SWgiLCJtYWMiOiJjOTAxODFhYzcxYTYyNmU3MGIxMDYwNjI2NWJkMTY5YjUxNjk3Yzc1YzhiMWNiZTQ4OGQ4M2YxNjdmZDU1NzkwIiwidGFnIjoiIn0%3D; anonymfile_session=eyJpdiI6Ik5Bc2NZb3hkK3ZrcjJtTnJkRS9Zc1E9PSIsInZhbHVlIjoidmlWTWlYNDk2V2RTdUpUR2xGR1l5OENEdkcvL3RMSlZHbUhudFcrVFUxR3hqZkdmM0Z1WWZvQ2ZMM0FCQ2dnZWE4UGlxTmhxQWREaTVnalhYZTUrbDFMUTRQcmlrdmZyb0tCZFQwUVkzUXZScXZJcGlidFkzd0hrVERyVUpYS2siLCJtYWMiOiI4YmViZDE0M2JiMmI2MmVkYjYzZDAxN2M4ZjlhNDY1ZTUyN2FkODM0ZGM1MmIzMzZlMjQxMWMxM2VjNzY3MmQ1IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/javascript
vary: Accept-Encoding
x-content-type-options: nosniff
date: Sun, 27 Nov 2022 16:54:01 GMT
last-modified: Sun, 27 Nov 2022 16:54:01 GMT
cache-control: max-age=31536000
etag: W/"0"
content-encoding: br
X-Firefox-Spdy: h2
nanouwho.com/1?z=5307589
200 OK 0 B IP
Analyzer Verdict Alert quad9 Sinkholed
GET /1?z=5307589 HTTP/1.1
Host: nanouwho.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: text/javascript
access-control-allow-credentials: true
access-control-allow-origin:
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-Sc, CVERSION, VERSION
x-trace-id: 13f1436e0ec0aa41087f806ae9af65c0
access-control-expose-headers: X-Sc
x-sc: eA4KiglDfhItam_zOiICYeIfRdDGF5m9EFIDOXiwXPqojOUIAB9kMbU_9LZN6gyv1bq1eZmWX1LAmZPWFaNyVLJhF3E=
set-cookie: scm=1; expires=Mon, 27 Nov 2023 16:54:02 GMT; secure; SameSite=None
OAID=4031b5b2896044aea6012946043e54e7; expires=Mon, 27 Nov 2023 16:54:02 GMT; secure; SameSite=None
oaidts=1669568042; expires=Mon, 27 Nov 2023 16:54:02 GMT; secure; SameSite=None
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, max-age=0
expires: Mon, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
X-Firefox-Spdy: h2
anonymfile.com/mkJOo/rbxphishing.exe
410 Gone 0 B URL HTTP/2 anonymfile.com/mkJOo/rbxphishing.exe
IP
ASN #24940 Hetzner Online GmbH
GET /mkJOo/rbxphishing.exe HTTP/1.1
Host: anonymfile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 410 Gone
server: nginx
content-type: text/html; charset=UTF-8
set-cookie: XSRF-TOKEN=eyJpdiI6Ik5Fd3hBR3JOQ3lIcS9uR2NYMU5QS3c9PSIsInZhbHVlIjoibGw4UDRSWHVHWnNUZG5RWURpUk96NXhOQVJQR2dwU21PWjNEbTZWS3QvRzA4UjF5ei80Rmt5dU9NenZYczFlMkw3NkhhVFNsZnFySHh6cTFGWDFFcG9SWG5HVGxYOU4xOFFtbktzL2g1N2RtZ21sMllTbEZDZGdOK0IrQW90SWgiLCJtYWMiOiJjOTAxODFhYzcxYTYyNmU3MGIxMDYwNjI2NWJkMTY5YjUxNjk3Yzc1YzhiMWNiZTQ4OGQ4M2YxNjdmZDU1NzkwIiwidGFnIjoiIn0%3D; expires=Sun, 27-Nov-2022 18:54:01 GMT; Max-Age=7200; path=/; samesite=lax
anonymfile_session=eyJpdiI6Ik5Bc2NZb3hkK3ZrcjJtTnJkRS9Zc1E9PSIsInZhbHVlIjoidmlWTWlYNDk2V2RTdUpUR2xGR1l5OENEdkcvL3RMSlZHbUhudFcrVFUxR3hqZkdmM0Z1WWZvQ2ZMM0FCQ2dnZWE4UGlxTmhxQWREaTVnalhYZTUrbDFMUTRQcmlrdmZyb0tCZFQwUVkzUXZScXZJcGlidFkzd0hrVERyVUpYS2siLCJtYWMiOiI4YmViZDE0M2JiMmI2MmVkYjYzZDAxN2M4ZjlhNDY1ZTUyN2FkODM0ZGM1MmIzMzZlMjQxMWMxM2VjNzY3MmQ1IiwidGFnIjoiIn0%3D; expires=Sun, 27-Nov-2022 18:54:01 GMT; Max-Age=7200; path=/; httponly; samesite=lax
date: Sun, 27 Nov 2022 16:54:01 GMT
x-page-speed: 1.13.35.2-0
cache-control: max-age=0, no-cache
X-Firefox-Spdy: h2
anonymfile.com/sw.js
404 Not Found 0 B IP
ASN #24940 Hetzner Online GmbH
GET /sw.js HTTP/1.1
Host: anonymfile.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/mkJOo/rbxphishing.exe
Cookie: XSRF-TOKEN=eyJpdiI6Ik5Fd3hBR3JOQ3lIcS9uR2NYMU5QS3c9PSIsInZhbHVlIjoibGw4UDRSWHVHWnNUZG5RWURpUk96NXhOQVJQR2dwU21PWjNEbTZWS3QvRzA4UjF5ei80Rmt5dU9NenZYczFlMkw3NkhhVFNsZnFySHh6cTFGWDFFcG9SWG5HVGxYOU4xOFFtbktzL2g1N2RtZ21sMllTbEZDZGdOK0IrQW90SWgiLCJtYWMiOiJjOTAxODFhYzcxYTYyNmU3MGIxMDYwNjI2NWJkMTY5YjUxNjk3Yzc1YzhiMWNiZTQ4OGQ4M2YxNjdmZDU1NzkwIiwidGFnIjoiIn0%3D; anonymfile_session=eyJpdiI6Ik5Bc2NZb3hkK3ZrcjJtTnJkRS9Zc1E9PSIsInZhbHVlIjoidmlWTWlYNDk2V2RTdUpUR2xGR1l5OENEdkcvL3RMSlZHbUhudFcrVFUxR3hqZkdmM0Z1WWZvQ2ZMM0FCQ2dnZWE4UGlxTmhxQWREaTVnalhYZTUrbDFMUTRQcmlrdmZyb0tCZFQwUVkzUXZScXZJcGlidFkzd0hrVERyVUpYS2siLCJtYWMiOiI4YmViZDE0M2JiMmI2MmVkYjYzZDAxN2M4ZjlhNDY1ZTUyN2FkODM0ZGM1MmIzMzZlMjQxMWMxM2VjNzY3MmQ1IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
server: nginx
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
date: Sun, 27 Nov 2022 16:54:02 GMT
x-page-speed: 1.13.35.2-0
cache-control: max-age=0, no-cache
content-encoding: br
X-Firefox-Spdy: h2
tzegilo.com/stattag.js
200 OK 0 B IP
GET /stattag.js HTTP/1.1
Host: tzegilo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://anonymfile.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Sun, 27 Nov 2022 16:54:02 GMT
content-type: application/javascript
last-modified: Wed, 23 Nov 2022 15:07:42 GMT
etag: W/"637e373e-32a6"
link: <https://flerap.com/>; rel=preconnect; crossorigin, <https://fleraprt.com/>; rel=preconnect; crossorigin
cache-control: max-age=14400
cf-cache-status: HIT
age: 2287
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6QbHhLiePEM7jdnxWr2v%2FSLO16jgFwuyOT3475Mofj%2FXbxlBntBjb64GZ9MsCLiOAyyFTaK4tdOs9Yq6%2FQdXq8%2F7hzQzLPWxTiFyPvvv7uaeCebsEAJGhFgGSYsFRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 770c622b5b520b3d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
138.201.48.112
139.45.197.234
23.36.76.226
34.160.144.191
104.17.25.14