hop.greenbluefrog.click/proc.php?1d6c5e6fe6d68af609d7719b8a2b94cfe6ac4b3a
108.178.23.115 5.1 kB URL hop.greenbluefrog.click/proc.php?1d6c5e6fe6d68af609d7719b8a2b94cfe6ac4b3a
IP 108.178.23.115:0
File type gzip compressed data, from Unix\012- data
Hash 5f099ed05a95a8d0272a17ccf8488f86
dcc7d7f66ab4fed349b74d4e2aa455b847f577b0
200965443b60b22cf53975dd16736de827215fb44f9a9f7c3b848bd55e8e1718
GET /proc.php?1d6c5e6fe6d68af609d7719b8a2b94cfe6ac4b3a HTTP/1.1
Host: hop.greenbluefrog.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hop.greenbluefrog.click/?utm_medium=e163292dbe69bf7b0443665e613ac9ee1397380a&utm_campaign=Backbutton&cid=w0ekflts6ed6vc4tiutv78fa
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 20:57:13 GMT
content-type: text/html; charset=UTF-8
location: https://www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7302909128798634002&website=24354-99b5e0ez&placement=24354
vary: Accept-Encoding
x-powered-by: PHP/8.2.12
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version
content-encoding: gzip
X-Firefox-Spdy: h2
hop.greenbluefrog.click/favicon.ico
108.178.23.115 1.2 kB URL hop.greenbluefrog.click/favicon.ico
IP 108.178.23.115:0
File type MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Hash 91abe01116ab422c598e9c8af72cf4da
0f2815fe8e067d48537ad168225ab4674271fa27
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
GET /favicon.ico HTTP/1.1
Host: hop.greenbluefrog.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hop.greenbluefrog.click/proc.php?1d6c5e6fe6d68af609d7719b8a2b94cfe6ac4b3a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Sat, 18 Nov 2023 20:57:13 GMT
content-type: image/x-icon
content-length: 1150
last-modified: Wed, 31 Jul 2019 07:48:51 GMT
etag: "5d4147e3-47e"
expires: Sun, 19 Nov 2023 20:57:13 GMT
cache-control: max-age=86400
strict-transport-security: max-age=31536000; includeSubdomains
accept-ranges: bytes
X-Firefox-Spdy: h2
www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7302909128798634002&website=24354-99b5e0ez&placement=24354&eyeg=f18c3ad8844ac9500fcaafc2421e1cfb&eyer=0.9757703451342569&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=hop.greenbluefrog.click
51.68.85.158302 Found 0 B URL User Request GET HTTP/1.1 www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7302909128798634002&website=24354-99b5e0ez&placement=24354&eyeg=f18c3ad8844ac9500fcaafc2421e1cfb&eyer=0.9757703451342569&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=hop.greenbluefrog.click
IP 51.68.85.158:443
Certificate IssuerLet's Encrypt
Subjectwww.tropbikewall.art
Fingerprint96:CD:1E:77:97:20:90:07:B6:97:97:FF:CB:6A:2E:1C:BC:95:B0:71
ValiditySat, 18 Nov 2023 02:12:43 GMT - Fri, 16 Feb 2024 02:12:42 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7302909128798634002&website=24354-99b5e0ez&placement=24354&eyeg=f18c3ad8844ac9500fcaafc2421e1cfb&eyer=0.9757703451342569&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=hop.greenbluefrog.click HTTP/1.1
Host: www.tropbikewall.art
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Sat, 18 Nov 2023 20:57:14 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-transform
Location: https://www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7302909128798634002&website=24354-99b5e0ez&placement=24354&eyeg=3&eyer=0.9757703451342569&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=hop.greenbluefrog.click
www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7302909128798634002&website=24354-99b5e0ez&placement=24354&eyeg=3&eyer=0.9757703451342569&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=hop.greenbluefrog.click
51.68.85.158302 Found 0 B URL User Request GET HTTP/1.1 www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7302909128798634002&website=24354-99b5e0ez&placement=24354&eyeg=3&eyer=0.9757703451342569&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=hop.greenbluefrog.click
IP 51.68.85.158:443
Certificate IssuerLet's Encrypt
Subjectwww.tropbikewall.art
Fingerprint96:CD:1E:77:97:20:90:07:B6:97:97:FF:CB:6A:2E:1C:BC:95:B0:71
ValiditySat, 18 Nov 2023 02:12:43 GMT - Fri, 16 Feb 2024 02:12:42 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7302909128798634002&website=24354-99b5e0ez&placement=24354&eyeg=3&eyer=0.9757703451342569&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=hop.greenbluefrog.click HTTP/1.1
Host: www.tropbikewall.art
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Sat, 18 Nov 2023 20:57:14 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-transform
Location: https://admoustache.media-412.com/sl?id=63ef5a2a8dec34873b6049c7&pid=503&sub1=33000582dd683f5cdb4e63e54f4d7882a93ae1118-202311-flb*5706540-e4d07*M7302909128798634002*sl_5706540-e4d07*740f0d391bfc4ad3647f23cd4233480d92a8ff14*24354-99b5e0ez*24354
www.tropbikewall.art/favicon.ico
51.68.85.158 0 B URL www.tropbikewall.art/favicon.ico
IP 51.68.85.158:0
Certificate IssuerLet's Encrypt
Subjectwww.tropbikewall.art
Fingerprint96:CD:1E:77:97:20:90:07:B6:97:97:FF:CB:6A:2E:1C:BC:95:B0:71
ValiditySat, 18 Nov 2023 02:12:43 GMT - Fri, 16 Feb 2024 02:12:42 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: www.tropbikewall.art
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 204 No Content
Date: Sat, 18 Nov 2023 20:57:14 GMT
Connection: keep-alive
admoustache.media-412.com/sl?id=63ef5a2a8dec34873b6049c7&pid=503&sub1=33000582dd683f5cdb4e63e54f4d7882a93ae1118-202311-flb*5706540-e4d07*M7302909128798634002*sl_5706540-e4d07*740f0d391bfc4ad3647f23cd4233480d92a8ff14*24354-99b5e0ez*24354
34.141.137.168302 Found 0 B URL User Request GET HTTP/2 admoustache.media-412.com/sl?id=63ef5a2a8dec34873b6049c7&pid=503&sub1=33000582dd683f5cdb4e63e54f4d7882a93ae1118-202311-flb*5706540-e4d07*M7302909128798634002*sl_5706540-e4d07*740f0d391bfc4ad3647f23cd4233480d92a8ff14*24354-99b5e0ez*24354
IP 34.141.137.168:443
ASN #396982 GOOGLE-CLOUD-PLATFORM
Certificate IssuerGoDaddy.com, Inc.
Subject*.media-412.com
Fingerprint16:AB:3B:E7:5C:01:8D:17:4C:E5:2A:16:CE:5F:3B:FB:DE:12:ED:4C
ValiditySun, 09 Jul 2023 20:53:14 GMT - Fri, 09 Aug 2024 20:53:14 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sl?id=63ef5a2a8dec34873b6049c7&pid=503&sub1=33000582dd683f5cdb4e63e54f4d7882a93ae1118-202311-flb*5706540-e4d07*M7302909128798634002*sl_5706540-e4d07*740f0d391bfc4ad3647f23cd4233480d92a8ff14*24354-99b5e0ez*24354 HTTP/1.1
Host: admoustache.media-412.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Sat, 18 Nov 2023 20:57:14 GMT
content-length: 0
location: https://yisparoturm.com/?cat=2&groupds=157&clientId=168&productId=1907&publisher_id=503&tracking=6559252ac100d40001fd11ad
x-adjust-use-original-forwarded-for: 1
referer:
referrer-policy: no-referrer
set-cookie: afclick=6559252ac100d40001fd11ad; expires=Sun, 17 Nov 2024 20:57:14 GMT; secure; SameSite=None
access-control-allow-origin: *
X-Firefox-Spdy: h2
yisparoturm.com/?cat=2&groupds=157&clientId=168&productId=1907&publisher_id=503&tracking=6559252ac100d40001fd11ad
185.32.28.133200 OK 7.2 kB URL User Request GET HTTP/1.1 yisparoturm.com/?cat=2&groupds=157&clientId=168&productId=1907&publisher_id=503&tracking=6559252ac100d40001fd11ad
IP 185.32.28.133:443
ASN #15699 OGIC Informatica S.L.
Certificate IssuerLet's Encrypt
Subjectyisparoturm.com
FingerprintCB:BF:DD:29:F9:01:9C:4C:8A:7C:71:D9:24:B5:CB:9C:86:5E:4C:AE
ValidityFri, 03 Nov 2023 09:26:51 GMT - Thu, 01 Feb 2024 09:26:50 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 769ba02bf9d905bec0d85118576d55c5
c1b68bd37ec26379e0404db70f2ddb7fe9482979
000111ed2ca54f80a310f1948ee9da7e98df45290720d18c915731ed432825b0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /?cat=2&groupds=157&clientId=168&productId=1907&publisher_id=503&tracking=6559252ac100d40001fd11ad HTTP/1.1
Host: yisparoturm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 20:57:09 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Set-Cookie: redirect_user_data=%7B%22country%22%3A%22NO%22%2C%22city%22%3Anull%2C%22isp%22%3A%22blix+solutions%22%2C%22netspeed%22%3A%22%22%7D; expires=Sat, 18-Nov-2023 21:07:09 GMT; Max-Age=600
_tracker_ikangoo=a%3A5%3A%7Bs%3A4%3A%22_key%22%3Bs%3A7%3A%22IKPANEL%22%3Bs%3A6%3A%22_subid%22%3Bs%3A16%3A%225002158367504530%22%3Bs%3A8%3A%22_country%22%3Bs%3A2%3A%22NO%22%3Bs%3A4%3A%22_isp%22%3Bs%3A14%3A%22blix+solutions%22%3Bs%3A5%3A%22_time%22%3Bi%3A1700341029%3B%7D; expires=Sat, 18-Nov-2023 20:59:09 GMT; Max-Age=120
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
yisparoturm.com/assets/js/backlink_back_button.js
185.32.28.133200 OK 632 B URL GET HTTP/1.1 yisparoturm.com/assets/js/backlink_back_button.js
IP 185.32.28.133:443
ASN #15699 OGIC Informatica S.L.
Requested by https://yisparoturm.com/?cat=2&groupds=157&clientId=168&productId=1907&publisher_id=503&tracking=6559252ac100d40001fd11ad
Certificate IssuerLet's Encrypt
Subjectyisparoturm.com
FingerprintCB:BF:DD:29:F9:01:9C:4C:8A:7C:71:D9:24:B5:CB:9C:86:5E:4C:AE
ValidityFri, 03 Nov 2023 09:26:51 GMT - Thu, 01 Feb 2024 09:26:50 GMT
Hash 7c847657cd58fd5f3b656c5dd486808a
54781827b08eb75f27786b20bfded403c3117a69
b1b1b5affe702bae9e97deabbdb3f19bcf8f12a1ddd410ff189c61c3bc159c06
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/backlink_back_button.js HTTP/1.1
Host: yisparoturm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://yisparoturm.com/?cat=2&groupds=157&clientId=168&productId=1907&publisher_id=503&tracking=6559252ac100d40001fd11ad
Cookie: redirect_user_data=%7B%22country%22%3A%22NO%22%2C%22city%22%3Anull%2C%22isp%22%3A%22blix+solutions%22%2C%22netspeed%22%3A%22%22%7D; _tracker_ikangoo=a%3A5%3A%7Bs%3A4%3A%22_key%22%3Bs%3A7%3A%22IKPANEL%22%3Bs%3A6%3A%22_subid%22%3Bs%3A16%3A%225002158367504530%22%3Bs%3A8%3A%22_country%22%3Bs%3A2%3A%22NO%22%3Bs%3A4%3A%22_isp%22%3Bs%3A14%3A%22blix+solutions%22%3Bs%3A5%3A%22_time%22%3Bi%3A1700341029%3B%7D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 Nov 2023 20:57:10 GMT
Content-Type: application/javascript
Content-Length: 632
Last-Modified: Mon, 28 Nov 2022 14:36:49 GMT
Connection: keep-alive
ETag: "6384c781-278"
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Accept-Ranges: bytes