Report - plankton-app-2-wt9hd.ondigitalocean.app/

Report Overview

Submitted URL

plankton-app-2-wt9hd.ondigitalocean.app/
IP

104.16.243.78

ASN

#13335 CLOUDFLARENET
Submitted

2022-09-25T05:43:34Z

Access
Website Title
Final URL
Tags

None
urlquery detections

Scam / Cryptowall detected

Scam / Fake AntiVirus

Detections

urlquery

16
Network Intrusion Detection

0
Threat Detection Systems

0

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
cdn.jsdelivr.net (2)	439	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	947	47479	151.101.85.229
ocsp.pki.goog (2)	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	662	1398	142.250.74.3
maxcdn.bootstrapcdn.com (1)	724	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	428	893	104.18.10.207
firefox.settings.services.mozilla.com (2)	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	758	2707	143.204.55.27
contile.services.mozilla.com (1)	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	321	229	34.117.237.239
push.services.mozilla.com (1)	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	594	127	35.164.56.167
ocsp.globalsign.com (1)	2075	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	356	1920	104.18.20.226
www.googletagmanager.com (1)	75	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	398	43001	142.250.74.72
plankton-app-2-wt9hd.ondigitalocean.app (21)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	9603	295612	104.16.244.78
ocsp.digicert.com (4)	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1316	2280	93.184.220.29
www.google-analytics.com (1)	40	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	384	20472	216.239.32.178
img-getpocket.cdn.mozilla.net (4)	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2116	44525	34.120.237.76
content-signature-2.cdn.mozilla.net (1)	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	401	5845	143.204.55.25
cdnjs.cloudflare.com (2)	235	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	814	32829	104.17.25.14
r3.o.lencr.org (5)	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1630	4430	23.36.77.32

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

HTTP Transactions (49)

URL IP Response Size

plankton-app-2-wt9hd.ondigitalocean.app/

104.16.244.78

301 Moved Permanently

URL HTTP/1.1

plankton-app-2-wt9hd.ondigitalocean.app/
IP

104.16.244.78:0
ASN

#13335 CLOUDFLARENET

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET / HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        HTTP/1.1 301 Moved Permanently
Date: Sun, 25 Sep 2022 05:43:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sun, 25 Sep 2022 06:43:22 GMT
Location: https://plankton-app-2-wt9hd.ondigitalocean.app/
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 750171207857b512-OSL

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

09a973de929ab7452edc342c780d3668

3f14f6e0a36f76863c0aea6fb561c266404a7ea3

e82ca5f310e37267fbf792427747e65c2bb35e684d3f629c0aa302f688bc4f80

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E82CA5F310E37267FBF792427747E65C2BB35E684D3F629C0AA302F688BC4F80"
Last-Modified: Fri, 23 Sep 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2317
Expires: Sun, 25 Sep 2022 06:22:00 GMT
Date: Sun, 25 Sep 2022 05:43:23 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

143.204.55.27

200 OK

939

URL HTTP/1.1

firefox.settings.services.mozilla.com/v1/
IP

143.204.55.27:0
ASN

#16509 AMAZON-02

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

2d12f67fe57a87e7366b662d153a5582

d7b02d81cc74f24a251d9363e0f4b0a149264ec1

73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Alert, Backoff, Retry-After, Content-Length
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sun, 25 Sep 2022 05:14:51 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 6480520a5e02f3163410e3134bd77baa.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: psKZcTDw13nvtHhonrkj1ooBrkJ0xNwWnBDbSTNapqK0FCYa25cFxg==
Age: 1712

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain

143.204.55.25

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
IP

143.204.55.25:0
ASN

#16509 AMAZON-02

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

6113f8408c59aebe188d6af273b90743

7398873bf00f99944eaa77ad3ebc0d43c23dba6b

b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Sun, 25 Sep 2022 04:35:15 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 475d4ecb64796af058573c6f1048e898.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: XVg6OhtVQAw-NClCN8uUJvB6aPhpXCEiCfM1CJmzdABBaU4FGSnNOw==
age: 4089
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

280

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

280
Hash

acb1b3c929ea04a928abf1f15565de34

75f3c81ef97f8d518bd75e6b9ddb99c73a099980

96530692146be308aaee00d645905a9a06c0d11ff4ac037a0aaa4d5dcfe9a44b

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 05:43:23 GMT
Server: ECS (amb/6B87)
Content-Length: 280

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

URL HTTP/2

contile.services.mozilla.com/v1/tiles
IP

34.117.237.239:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with no line terminators

Size

12
Hash

23e88fb7b99543fb33315b29b1fad9d6

a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

                                        GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Sun, 25 Sep 2022 05:43:23 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

143.204.55.27

200 OK

329

URL HTTP/1.1

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP

143.204.55.27:0
ASN

#16509 AMAZON-02

Magic

JSON data\012- , ASCII text, with very long lines (329), with no line terminators

Size

329
Hash

0333b0655111aa68de771adfcc4db243

63f295a144ac87a7c8e23417626724eeca68a7eb

60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

                                        GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Sun, 25 Sep 2022 05:04:17 GMT
Cache-Control: max-age=3600, max-age=3600
Expires: Sun, 25 Sep 2022 05:06:19 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 aa34a836095df9de9d246a53dd63f1d6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: rNJmvPXoej8wNS5HVg82G8F37jGbBIVB0BSerFZH0CevQFO5AICnew==
Age: 2346

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

a7809de115ea73f8b61f3d20a9978493

01fc65a2b694d7aadd5204d21801e87b2b55b73e

72692486033feeb149424c59576c6c75b17228dfc89b4c369d2e17cc4bff3d52

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6288
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 05:43:23 GMT
Last-Modified: Sun, 25 Sep 2022 03:58:35 GMT
Server: ECS (ska/F710)
X-Cache: HIT
Content-Length: 471

push.services.mozilla.com/

35.164.56.167

101 Switching Protocols

URL HTTP/1.1

push.services.mozilla.com/
IP

35.164.56.167:0
ASN

#16509 AMAZON-02

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: dvb8kGw/fb0CTBm2HNXr9w==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: vLpYsQgEmKj8TgRz30DanzAaNUU=

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

14c4f50e0f41f858e858b124dcc866ec

1ad2814c77a84887c0f1547a775737e3e6c83f01

fa075971e9f184bf8d79929bbd7e981414d78f12ea06e3246ea4adfa2fbf4eeb

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4321
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 05:43:24 GMT
Last-Modified: Sun, 25 Sep 2022 04:31:23 GMT
Server: ECS (ska/F710)
X-Cache: HIT
Content-Length: 279

cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js

104.17.25.14

200 OK

26660

URL HTTP/2

cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js
IP

104.17.25.14:0
ASN

#13335 CLOUDFLARENET

Magic

ASCII text, with very long lines (32180)

Size

26660
Hash

b1e4b2a99336201b37fb8cea5d57abb9

d57980f0d0eaaf57ec33ddc9ed027274cfa86027

c805bfd991983f57b5b7878b998f7529e9b7e2df4bc2d39ba493934e23ba3f8a

HTTP Headers

                                        GET /ajax/libs/jquery/2.1.3/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: application/javascript; charset=utf-8
content-length: 26660
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec4-14983"
last-modified: Mon, 04 May 2020 16:11:48 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-cache-status: HIT
age: 9531392
expires: Fri, 15 Sep 2023 05:43:24 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6SW6DLwDdSqshF6NsixA1d1nRm%2BgXJVzFOV%2Bx8glzjuRcEohobfsFavWVy60XnS%2F4g975UjpH8DBU2sOkd%2FUtlbavLy7X2NI4aFMWGlvwvYUqCXBlBxfsTcwm0wd1ANBbOCwzWvq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 750171288e5ab52d-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/modernizr/2.8.3/modernizr.min.js

104.17.25.14

200 OK

3980

URL HTTP/2

cdnjs.cloudflare.com/ajax/libs/modernizr/2.8.3/modernizr.min.js
IP

104.17.25.14:0
ASN

#13335 CLOUDFLARENET

Magic

HTML document, ASCII text, with very long lines (11084), with no line terminators

Size

3980
Hash

a5775b673c18ffa903cd1a6129ce5f87

ee2569b285a7dbc4ccc95b01a16f06943fade768

ab8ad2f07d5214be2ade4edcd295d5fb8f8aa60971b3ec1348063a8a19659fc9

HTTP Headers

                                        GET /ajax/libs/modernizr/2.8.3/modernizr.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: application/javascript; charset=utf-8
content-length: 3980
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03f26-2b4c"
last-modified: Mon, 04 May 2020 16:13:26 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 196971
expires: Fri, 15 Sep 2023 05:43:24 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cHncFeHeqT%2FtNK3PQS7%2FyLQiAZmFQsmK%2FHl0kNc3oq%2BvLgwTU3z5gR4vq4JH4XvhpY46Jx1OK8cEg%2Boypv4NeaiZM9onJ1g%2F9Er6DKsHr0npK8Kk5Nu4jaimITxjRgWf3iyBk%2Bam"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 75017128ae67b52d-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/bootstrap.bundle.min.js

151.101.85.229

200 OK

21830

URL HTTP/2

cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/bootstrap.bundle.min.js
IP

151.101.85.229:0
ASN

#54113 FASTLY

Magic

ASCII text, with very long lines (65299)

Size

21830
Hash

a5cbb97cf034dd181106adecdafe3035

5fca1af6c76dd3e609f7f92841e564df1281927a

5ae018daf5df2cd903f80162efbaa3e138e0ed47ff90a315f2e2c497dc88a890

HTTP Headers

                                        GET /npm/bootstrap@4.6.0/dist/js/bootstrap.bundle.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://plankton-app-2-wt9hd.ondigitalocean.app
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 4.6.0
x-jsd-version-type: version
etag: W/"1499a-rsVR5NVzRjCI/KfRT7ZE6zifGDk"
content-encoding: gzip
accept-ranges: bytes
date: Sun, 25 Sep 2022 05:43:24 GMT
age: 9773247
x-served-by: cache-fra19162-FRA, cache-bma1670-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 21830
X-Firefox-Spdy: h2

cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css

151.101.85.229

200 OK

24100

URL HTTP/2

cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
IP

151.101.85.229:0
ASN

#54113 FASTLY

Magic

ASCII text, with very long lines (65326)

Size

24100
Hash

849f3e827da80e4e4c6a8c49689f057d

035d81aaaf6da3ffa5ce241179a9e14d533e7a3b

9546dbb82c3facf833e4adb713ce7e57a34dd53f6b55697ef1e1877bdbd8bb73

HTTP Headers

                                        GET /npm/bootstrap@4.6.0/dist/css/bootstrap.min.css HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://plankton-app-2-wt9hd.ondigitalocean.app
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
x-jsd-version: 4.6.0
x-jsd-version-type: version
etag: W/"27681-LKxK/BIJg5IUESlr1Oj9ipS6I34"
content-encoding: gzip
accept-ranges: bytes
date: Sun, 25 Sep 2022 05:43:24 GMT
age: 541378
x-served-by: cache-fra19147-FRA, cache-bma1670-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 24100
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

14c4f50e0f41f858e858b124dcc866ec

1ad2814c77a84887c0f1547a775737e3e6c83f01

fa075971e9f184bf8d79929bbd7e981414d78f12ea06e3246ea4adfa2fbf4eeb

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4321
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 05:43:24 GMT
Last-Modified: Sun, 25 Sep 2022 04:31:23 GMT
Server: ECS (ska/F710)
X-Cache: HIT
Content-Length: 279

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.3:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

58b52380a6b5c598d1ad88e8da148137

a56206a0277aea6e8e2f7629793aba713d8edd0c

561a57c27dfa1f8651a89292428576b626e8700b9cd6b8173a0ce121aa8f9f4a

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 05:43:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.globalsign.com/ca/gsatlasr3dvtlsca2022q1

104.18.20.226

200 OK

1462

URL HTTP/1.1

ocsp.globalsign.com/ca/gsatlasr3dvtlsca2022q1
IP

104.18.20.226:0
ASN

#13335 CLOUDFLARENET

Magic

data

Size

1462
Hash

7b6633694e6205c440ff600454d421d2

d8e715a8c2f66e09b51d973a89880e78632ca4ca

de9811cc7159aac6221de11dff48bde2ba4d3abfb3e74296b078b567664ce473

HTTP Headers

                                        POST /ca/gsatlasr3dvtlsca2022q1 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Date: Sun, 25 Sep 2022 05:43:24 GMT
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
Etag: "B5E10DC62D3A92969D138DE085CCFE86C6BA4409"
Expires: Sun, 25 Sep 2022 16:00:00 GMT
Last-Modified: Sun, 25 Sep 2022 04:00:00 UTC
Cache-Control: s-maxage=3600, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Age: 2953
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 75017128e82e0b55-OSL

www.googletagmanager.com/gtag/js?id=UA-217279329-25

142.250.74.72

200 OK

42238

URL HTTP/2

www.googletagmanager.com/gtag/js?id=UA-217279329-25
IP

142.250.74.72:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (1720)

Size

42238
Hash

bb106cae80b5271e1f722a9e6a97aefa

cde1c02f48b2a9eb3941c29ea6454ade7914daea

1eabab5159429d81326f13d7f847fcb0bb8a21a26a7c95f86aa275dd842172ca

HTTP Headers

                                        GET /gtag/js?id=UA-217279329-25 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 25 Sep 2022 05:43:24 GMT
expires: Sun, 25 Sep 2022 05:43:24 GMT
cache-control: private, max-age=900
last-modified: Sun, 25 Sep 2022 03:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 42238
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.3

200 OK

471

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.3:0
ASN

#15169 GOOGLE

Magic

data

Size

471
Hash

58b52380a6b5c598d1ad88e8da148137

a56206a0277aea6e8e2f7629793aba713d8edd0c

561a57c27dfa1f8651a89292428576b626e8700b9cd6b8173a0ce121aa8f9f4a

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 25 Sep 2022 05:43:24 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/bell.png

104.16.243.78

200 OK

1108

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/bell.png
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced\012- data

Size

1108
Hash

a3555871399f1f67bfacaf437974b03a

b6337de87cd7a75a73cd804774651d14c83fe76a

2e48fef820929c21295e13444901f60e3aed61ba6f8c773ff1466e6843e76b49

Detections

Analyzer	Verdict	Alert
urlquery		Scam / Fake AntiVirus

HTTP Headers

                                        GET /werrx01/bell.png HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: image/png
content-length: 1108
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
etag: "454-11ef9b484c240"
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 750171286daf0b45-OSL
X-Firefox-Spdy: h2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/microsoft.png

104.16.243.78

200 OK

1045

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/microsoft.png
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

PNG image data, 47 x 46, 8-bit/color RGBA, non-interlaced\012- data

Size

1045
Hash

bf2b460590fbb9d8e9611a6e9006b816

561e1dab259d61e798b3ce380527b71b61074ff3

ee4bc5fe81fa7c1e8497d79c9c8a96485df217092d334e9b48fa8840fed11d03

Detections

Analyzer	Verdict	Alert
urlquery		Scam / Fake AntiVirus

HTTP Headers

                                        GET /werrx01/microsoft.png HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: image/png
content-length: 1045
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
etag: "415-11ef9b484c240"
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 750171286daa0b45-OSL
X-Firefox-Spdy: h2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/def.png

104.16.243.78

200 OK

3834

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/def.png
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced\012- data

Size

3834
Hash

77a2ffc5545f87551d74781201de9b3b

c9c3798afd2ae95aa3bba3c428335d49c8255b06

316e6a6737bd296ab30aca2ef7fa36f119d15786a2432d01e31fdc130272f15c

Detections

Analyzer	Verdict	Alert
urlquery		Scam / Fake AntiVirus

HTTP Headers

                                        GET /werrx01/def.png HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: image/png
content-length: 3834
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
etag: "efa-11ef9b484c240"
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 750171286db10b45-OSL
X-Firefox-Spdy: h2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/pc.png

104.16.243.78

200 OK

4949

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/pc.png
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

PNG image data, 166 x 92, 8-bit/color RGBA, non-interlaced\012- data

Size

4949
Hash

cc5132b56ba46b03dd998aa1fe220106

403e007a0b17d76a9945fa5ec46a9d01733b3040

598699133be5eef63e3b9b5540609ec0dc91d7af9c7f70a3b890e57491a70ae0

Detections

Analyzer	Verdict	Alert
urlquery		Scam / Fake AntiVirus

HTTP Headers

                                        GET /werrx01/pc.png HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: image/png
content-length: 4949
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
etag: "1355-11ef9b484c240"
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 750171286db00b45-OSL
X-Firefox-Spdy: h2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/minimize.jpg

104.16.243.78

200 OK

2247

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/minimize.jpg
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 180x39, components 3\012- data

Size

2247
Hash

1ba392dce74f8987dca48bf65d817c8f

db0b8444c46125105b52f272bd422a7f52da1f72

a05245b6f7fd752af4a7b0131bbdfdf3eaee6c5a25a81cb498e0f0759189473c

Detections

Analyzer	Verdict	Alert
urlquery		Scam / Fake AntiVirus

HTTP Headers

                                        GET /werrx01/minimize.jpg HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: image/jpeg
content-length: 2247
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
etag: "8c7-11ef9b484c240"
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 750171286da80b45-OSL
X-Firefox-Spdy: h2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/virus-images.jpg

104.16.243.78

200 OK

8196

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/virus-images.jpg
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 254x71, components 3\012- data

Size

8196
Hash

5fc559a242f0ea0a023f10830887d2af

9d744c2f3a6bf5b715496350c8de7124cdd7ddc8

3b531d403dc8ce7cbb0efb1a0c307cfb2bbaaf21feaff9f3546f13bebda71887

Detections

Analyzer	Verdict	Alert
urlquery		Scam / Fake AntiVirus

HTTP Headers

                                        GET /werrx01/virus-images.jpg HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: image/jpeg
content-length: 8196
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
etag: "2004-11ef9b484c240"
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 750171287db90b45-OSL
X-Firefox-Spdy: h2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/setting.png

104.16.243.78

200 OK

364

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/setting.png
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

PNG image data, 12 x 12, 8-bit/color RGB, non-interlaced\012- data

Size

364
Hash

e144c3378090087c8ce129a30cb6cb4e

59da5466551de941d0215e45c54aa2ceaf436be1

b13a03e0db893734298cbe203bf264407636ffe5dab0a141f83c492d0034dd6a

Detections

Analyzer	Verdict	Alert
urlquery		Scam / Fake AntiVirus

HTTP Headers

                                        GET /werrx01/setting.png HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: image/png
content-length: 364
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
etag: "16c-11ef9b484c240"
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 750171286dab0b45-OSL
X-Firefox-Spdy: h2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/que.png

104.16.243.78

200 OK

349

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/que.png
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

PNG image data, 13 x 13, 8-bit/color RGB, non-interlaced\012- data

Size

349
Hash

7454c652e0733d92de6c920c2d646ae0

34a5bd8c7401f95e346895b0e5ccffbf0e9ad638

44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7

Detections

Analyzer	Verdict	Alert
urlquery		Scam / Fake AntiVirus

HTTP Headers

                                        GET /werrx01/que.png HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: image/png
content-length: 349
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
etag: "15d-11ef9b484c240"
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 750171286dad0b45-OSL
X-Firefox-Spdy: h2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/virus-scan.png

104.16.243.78

200 OK

25871

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/virus-scan.png
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced\012- data

Size

25871
Hash

2c497dfff84bd8c5af9254c9d6278ce1

667e72e7ba6f00a54629e28133317022d4b59af6

b2dc4153ee7019c70a1095d5d1304d540e3bba045d99e141f63e5b13362e5a4e

Detections

Analyzer	Verdict	Alert
urlquery		Scam / Fake AntiVirus

HTTP Headers

                                        GET /werrx01/virus-scan.png HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: image/png
content-length: 25871
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
etag: "650f-11ef9b484c240"
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 750171286dae0b45-OSL
X-Firefox-Spdy: h2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/cross.png

104.16.243.78

200 OK

44098

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/cross.png
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

PNG image data, 2080 x 2080, 8-bit/color RGBA, non-interlaced\012- data

Size

44098
Hash

4487a588bf2a07e3d1936d705c5ceefd

db193b3e2ab9fbee6eae99ced2366b1ef5f16971

3821ef20f5904fdb993e34d87ff8fb9c5786a382efb0eeee8b4f00c91428b701

Detections

Analyzer	Verdict	Alert
urlquery		Scam / Fake AntiVirus

HTTP Headers

                                        GET /werrx01/cross.png HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: image/png
content-length: 44098
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
etag: "ac42-11ef9b484c240"
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 750171286db20b45-OSL
X-Firefox-Spdy: h2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/bg2.jpg

104.16.243.78

200 OK

101218

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/bg2.jpg
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1920x1080, components 3\012- data

Size

101218
Hash

21e2ac3edb976d4b8c2018eff70f084d

8891207a1729c77c4be38ee3dae75bb240c8a92b

d442ddd2a4f0354eff40d09b4e54d0fa27580e9cbe17afffa8c70a5f496cd92a

Detections

Analyzer	Verdict	Alert
urlquery		Scam / Fake AntiVirus

HTTP Headers

                                        GET /werrx01/bg2.jpg HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: image/jpeg
content-length: 101218
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
etag: "18b62-11ef9b484c240"
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 750171286da70b45-OSL
X-Firefox-Spdy: h2

www.google-analytics.com/analytics.js

216.239.32.178

200 OK

19826

URL HTTP/2

www.google-analytics.com/analytics.js
IP

216.239.32.178:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (1325)

Size

19826
Hash

cae538dcce82598fbe43c0bf443e62dd

cc68ac6be9c5e0087a0000e5735b83270ace30f5

954b9e9d9744e1319c51760780a35de2dec353afffac705c2cca6d836a5e056d

HTTP Headers

                                        GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 19826
date: Sun, 25 Sep 2022 04:29:41 GMT
expires: Sun, 25 Sep 2022 06:29:41 GMT
cache-control: public, max-age=7200
age: 4424
last-modified: Sun, 11 Sep 2022 13:50:09 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/fullscreen.js

104.16.243.78

200 OK

134

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/fullscreen.js
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

ASCII text, with CRLF line terminators

Size

134
Hash

eab6b56997acd26c0c10f1203fad5f3b

ffbdada70a09ee3e8f4d0609c3dcf9637b78cf94

f280c3da63f3c75271b974f4b59a3c8150ead05323dfb3d1691eeca5780892e1

HTTP Headers

                                        GET /werrx01/fullscreen.js HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: application/javascript
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
etag: W/"f5-11ef9b484c240"
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
vary: Accept-Encoding
server: cloudflare
cf-ray: 750171287dba0b45-OSL
content-encoding: br
X-Firefox-Spdy: h2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/0wa0rni0ng0.mp3

104.16.243.78

206 Partial Content

8405

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/0wa0rni0ng0.mp3
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 56 kbps, 44.1 kHz, Monaural\012- data

Size

8405
Hash

8618fbb0911e3b8fc96725dee8bfd81f

1bbcb78922946d0cf18fbf3a9e092e36453eb767

0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1

Detections

Analyzer	Verdict	Alert
urlquery		Scam / Fake AntiVirus

HTTP Headers

                                        GET /werrx01/0wa0rni0ng0.mp3 HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 206 Partial Content
date: Sun, 25 Sep 2022 05:43:25 GMT
content-type: audio/mpeg
content-length: 8405
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
etag: "20d5-11ef9b484c240"
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
content-range: bytes 0-8404/8405
server: cloudflare
cf-ray: 7501712b9f3b0b45-OSL
X-Firefox-Spdy: h2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&

104.16.243.78

200 OK

7010

URL HTTP/2

plankton-app-2-wt9hd.ondigitalocean.app/werrx01/?phone=+&
IP

104.16.243.78:0
ASN

#13335 CLOUDFLARENET

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with CRLF line terminators

Size

7010
Hash

95dbc8d74e62602889a891bca4a90c18

8e1fef8068632dd4239ad4d76f0d3ab1d3cea9d2

40999f2fd32d76dd880cb59ed95f91602481b80c6cc65fc6736aafe1e7a1253c

Detections

Analyzer	Verdict	Alert
urlquery		Scam / Cryptowall detected

HTTP Headers

                                        GET /werrx01/?phone=+& HTTP/1.1
Host: plankton-app-2-wt9hd.ondigitalocean.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://plankton-app-2-wt9hd.ondigitalocean.app/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
date: Sun, 25 Sep 2022 05:43:24 GMT
content-type: text/html
last-modified: Tue, 01 Jan 1980 00:00:01 GMT
x-do-app-origin: 80fe3680-4149-454d-a51b-70fce902fe20
cache-control: private
x-do-orig-status: 200
cf-cache-status: MISS
vary: Accept-Encoding
server: cloudflare
cf-ray: 750171257c1e0b45-OSL
content-encoding: br
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (26)

#1 JS:Script (size: 366)

URL

IP

ASN

Introduced by

Inline HTML

Observations

Hash

#2 JS:Script (size: 3905)

URL

IP

ASN

Introduced by

Inline HTML

Observations

Hash

#3 JS:Script (size: 268)

URL

IP

ASN

Introduced by

Inline HTML

Observations

Hash

#4 JS:Script (size: 84355)

URL

IP

ASN

Introduced by

Inline HTML

Observations

Hash

#5 JS:Script (size: 11084)

URL

IP

ASN

Introduced by

Inline HTML

Observations

Hash

#6 JS:Script (size: 84378)

URL

IP

ASN

Introduced by

Inline HTML

Observations

Hash

#7 JS:Script (size: 108655)

URL

IP

ASN

Introduced by

Inline HTML

Observations