WEBSITE ANALYSIS REPORT

https://eday.item.com.login.secured.karapapati.com/

17 Oct 2026 · 22:53:19.000 UTCpublic

Report tags
Submit tags: openphish

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

13341218.fls.doubleclick.net1 captured requests
ad.doubleclick.net3 captured requests
adservice.google.com1 captured requests
alb.reddit.com2 captured requests
connect.facebook.net4 captured requests
ct.pinterest.com10 captured requests
dnacdn.net2 captured requests
dynamic.criteo.com2 captured requests
eday.item.com.login.secured.karapapati.com7 captured requests
googleads.g.doubleclick.net10 captured requests
gum.criteo.com1 captured requests
ir.ebaystatic.com6 captured requests
mkttag.ebay.com18 captured requests
pixel-config.reddit.com2 captured requests
rover.ebay.com2 captured requests
s.pinimg.com4 captured requests
sc-static.net2 captured requests
svcs.ebay.com2 captured requests
tags.tiqcdn.com1 captured requests
tr.snapchat.com6 captured requests
tr6.snapchat.com1 captured requests
www.ebayadservices.com2 captured requests
www.facebook.com2 captured requests
www.google.com32 captured requests
www.google.no10 captured requests
www.googletagmanager.com6 captured requests
www.redditstatic.com2 captured requests

Connections

13341218.fls.doubleclick.net → adservice.google.comLoads from1 captured connections
ad.doubleclick.net → www.google.comRedirects to2 captured connections
eday.item.com.login.secured.karapapati.com → 13341218.fls.doubleclick.netEmbeds1 captured connections
eday.item.com.login.secured.karapapati.com → ad.doubleclick.netCalls3 captured connections
eday.item.com.login.secured.karapapati.com → alb.reddit.comCalls2 captured connections
eday.item.com.login.secured.karapapati.com → connect.facebook.netLoads from4 captured connections
eday.item.com.login.secured.karapapati.com → ct.pinterest.comCalls8 captured connections
eday.item.com.login.secured.karapapati.com → ct.pinterest.comEmbeds2 captured connections
eday.item.com.login.secured.karapapati.com → dynamic.criteo.comLoads from2 captured connections
eday.item.com.login.secured.karapapati.com → googleads.g.doubleclick.netLoads from10 captured connections
eday.item.com.login.secured.karapapati.com → gum.criteo.comEmbeds1 captured connections
eday.item.com.login.secured.karapapati.com → ir.ebaystatic.comLoads from6 captured connections
eday.item.com.login.secured.karapapati.com → mkttag.ebay.comLoads from18 captured connections
eday.item.com.login.secured.karapapati.com → pixel-config.reddit.comCalls2 captured connections
eday.item.com.login.secured.karapapati.com → rover.ebay.comLoads from2 captured connections
eday.item.com.login.secured.karapapati.com → s.pinimg.comLoads from4 captured connections
eday.item.com.login.secured.karapapati.com → sc-static.netLoads from2 captured connections
eday.item.com.login.secured.karapapati.com → svcs.ebay.comLoads from2 captured connections
eday.item.com.login.secured.karapapati.com → tags.tiqcdn.comLoads from1 captured connections
eday.item.com.login.secured.karapapati.com → tr.snapchat.comCalls2 captured connections
eday.item.com.login.secured.karapapati.com → tr.snapchat.comEmbeds2 captured connections
eday.item.com.login.secured.karapapati.com → tr.snapchat.comLoads from2 captured connections
eday.item.com.login.secured.karapapati.com → tr6.snapchat.comCalls1 captured connections
eday.item.com.login.secured.karapapati.com → www.ebayadservices.comLoads from2 captured connections
eday.item.com.login.secured.karapapati.com → www.facebook.comLoads from2 captured connections
eday.item.com.login.secured.karapapati.com → www.google.comCalls22 captured connections
eday.item.com.login.secured.karapapati.com → www.google.comLoads from10 captured connections
eday.item.com.login.secured.karapapati.com → www.google.noLoads from10 captured connections
eday.item.com.login.secured.karapapati.com → www.googletagmanager.comLoads from6 captured connections
eday.item.com.login.secured.karapapati.com → www.redditstatic.comLoads from2 captured connections
gum.criteo.com → dnacdn.netCalls2 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

22:52:28.420 GET 200 document 33.4 KB 124 ms 5 alerts

22:52:28.831 GET 200 stylesheet 89.6 KB 52 ms 5 alerts

22:52:28.835 GET 200 stylesheet 110.2 KB 48 ms 5 alerts

22:52:29.094 GET 200 subdocument 33.4 KB 37 ms 5 alerts

22:52:29.099 GET 200 img 125 B 531 ms —

22:52:29.102 GET 200 img 42 B 194 ms —

22:52:29.104 GET 200 img 1.1 KB 48 ms —

22:52:29.113 GET 200 img 6.7 KB 40 ms —

22:52:29.118 GET 200 img 42 B 204 ms —

22:52:29.166 GET 200 font 21.6 KB 13 ms —

22:52:29.254 GET 200 font 21.9 KB 27 ms —

22:52:29.267 GET 200 script 1.5 KB 139 ms —

22:52:29.276 GET 200 stylesheet 89.6 KB 25 ms 5 alerts

Transaction #18

Request / response

URL

GET HTTPS

https://eday.item.com.login.secured.karapapati.com/index_lcNW.c9dfc033.css

IP / ASN

157.173.106.238

AS51167 · Contabo GmbH

Requested by: https://eday.item.com.login.secured.karapapati.com/#

Resource information

File type: ASCII text, with very long lines (65536), with no line terminators
MIME type: text/css
First seen (UTC): 06 Feb 2025 · 07:43:13.439 UTC
Last seen (UTC): 18 Oct 2026 · 09:00:47.251 UTC
Times seen: 54

Size: 89.6 KB (91773 bytes)
MD5: 97aad29accf7b7e8423d4b4cd72255ff
SHA1: 426d732e29942e6c71794b5e78243519bea0c105
SHA256: 018ed7f439d3b104bfd43b4e1d3a477157afdd1d2933758bd23dedbcf283f55e

Certificate information

Issuer: Let's Encrypt · YR2
Subject: eday.item.com.login.secured.karapapati.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: C2:53:B1:92:81:A0:F1:A9:41:D3:CC:F1:83:CB:A6:E5:53:10:D8:DF
Valid from: Fri, 11 Sep 2026 18:02:17 GMT
Valid until: Thu, 10 Dec 2026 18:02:16 GMT

Technology fingerprints

No technology fingerprints recorded for this response.

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
Cloudflare DNS Sinkholed	medium	Malicious
CIRA Canadian Shield DNS Sinkholed	medium	Malicious
DNS4EU Sinkholed	medium	Malicious
Quad9 DNS Sinkholed	medium	Malicious
OpenDNS Phishing Block	medium	Phishing

HTTP headers

Request headers

GET /index_lcNW.c9dfc033.css HTTP/1.1
Host: eday.item.com.login.secured.karapapati.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Referer: https://eday.item.com.login.secured.karapapati.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Priority: u=2
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 
cache-control: public, max-age=604800
expires: Sat, 24 Oct 2026 22:52:29 GMT
content-type: text/css
last-modified: Wed, 02 Jul 2025 12:07:04 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 14467
date: Sat, 17 Oct 2026 22:52:29 GMT
X-Firefox-Spdy: h2

22:52:29.278 GET 200 stylesheet 110.2 KB 46 ms 5 alerts

22:52:29.284 GET 200 img 125 B 531 ms —

22:52:29.285 GET 200 img 42 B 192 ms —

22:52:29.286 GET 200 img 1.1 KB 10 ms —

22:52:29.287 GET 200 img 6.7 KB 10 ms —

22:52:29.289 GET 200 img 42 B 191 ms —

22:52:29.382 GET 200 script 1.5 KB 24 ms —

22:52:29.490 GET 200 script 71.4 KB 19 ms —

22:52:29.493 GET 200 script 71.4 KB 22 ms —

22:52:29.576 GET 200 script 16.4 KB 31 ms —

22:52:29.580 GET 200 script 22.8 KB 278 ms —

22:52:29.583 GET 200 script 15.0 KB 25 ms —

22:52:29.585 GET 200 script 14.0 KB 23 ms —

22:52:29.588 GET 200 script 14.5 KB 21 ms —

22:52:29.749 GET 200 script 18.1 KB 34 ms —

22:52:29.754 GET 200 script 17.5 KB 31 ms —

22:52:29.827 GET 200 script 16.4 KB 30 ms —

22:52:29.828 GET 200 script 22.8 KB 242 ms —

22:52:29.831 GET 200 script 15.0 KB 26 ms —

22:52:29.833 GET 200 script 14.0 KB 24 ms —

22:52:29.836 GET 200 script 14.5 KB 21 ms —

22:52:29.838 GET 200 script 18.1 KB 20 ms —

22:52:29.840 GET 200 script 17.5 KB 39 ms —

22:52:29.848 GET 404 img 796 B 25 ms 5 alerts

22:52:29.872 GET 200 script 75.8 KB 3620 ms —

22:52:29.876 GET 200 script 484.8 KB 156 ms —

22:52:29.877 GET 200 script 57.9 KB 113 ms —

22:52:29.897 GET 200 script 86.4 KB 50 ms —

22:52:29.899 GET 200 script 5.0 KB 47 ms —

22:52:29.911 GET 200 script 423.2 KB 117 ms —

22:52:29.917 GET 200 script 75.8 KB 124 ms —

22:52:29.920 GET 200 script 484.8 KB 104 ms —

22:52:29.922 GET 200 script 57.9 KB 45 ms —

22:52:29.924 GET 200 script 86.4 KB 26 ms —

22:52:29.927 GET 200 script 5.0 KB 14 ms —

22:52:30.219 POST 200 fetch 0 B 140 ms —

22:52:30.221 GET 200 xhr 478 B 46 ms —

https://eday.item.com.login.secured.karapapati.com/

Domain graph

Hostnames

Connections

Network requests

Transaction #18

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>https://eday.item.com.login.secured.karapapati.com/

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #18

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

https://eday.item.com.login.secured.karapapati.com/

Domain graph

Network requests