WEBSITE ANALYSIS REPORT

http://download.9mcstorage.com/dl2.php?file=Actions-and-Stuff-1.10.1.mcpack

07 Jun 2026 · 15:44:23.000 UTCpublic

Report tags
Submit tags

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

15:43:58.740 GET 200 document 9.6 KB 82 ms —

15:43:59.286 GET 200 stylesheet 12.7 KB 83 ms —

15:43:59.289 GET 200 script 163.0 KB 44 ms 2 alerts

15:43:59.291 GET 200 script 5 B 175 ms 1 alerts

15:43:59.422 GET 200 script 5 B 67 ms 1 alerts

15:43:59.429 GET 200 img 51.0 KB 55 ms —

15:43:59.459 GET 200 font 42.1 KB 85 ms —

15:43:59.462 GET 200 font 42.1 KB 77 ms —

15:43:59.463 GET 200 font 20.1 KB 77 ms —

15:43:59.465 GET 200 font 20.1 KB 76 ms —

15:43:59.468 GET 200 font 12.2 KB 44 ms —

15:43:59.518 GET 200 script 50.0 KB 539 ms 1 alerts

Transaction #46

Request / response

URL

GET HTTPS

https://creasereturndisplayed.com/30d02cd80a5f0482ae8df9cffe081689/invoke.js

IP / ASN

172.240.127.234

AS7979 · SERVERS-COM

Requested by: https://download.9mcstorage.com/dl2.php?file=Actions-and-Stuff-1.10.1.mcpack

Resource information

File type: JavaScript source, ASCII text, with very long lines (51173), with no line terminators
MIME type: application/javascript
First seen (UTC): 31 May 2026 · 19:58:30.255 UTC
Last seen (UTC): 26 Jun 2026 · 21:29:14.926 UTC
Times seen: 5

Size: 50.0 KB (51173 bytes)
MD5: ce49bb10ee4354cd45b4c4f30cd45f26
SHA1: 18cd450d31038c099a793c9c4fcbeb460bc6da7f
SHA256: a37adeee3f64772490e3ef4d9f373283f57188245733235bca3bc8b1c519d150

Certificate information

Issuer: Let's Encrypt · R13
Subject: creasereturndisplayed.com
Protocol / cipher: TLSv1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
SHA1 fingerprint: DE:CC:A5:3D:9B:0E:77:BA:49:CA:0F:59:9E:B4:F5:5D:87:AF:9E:22
Valid from: Tue, 28 Apr 2026 21:14:09 GMT
Valid until: Mon, 27 Jul 2026 21:14:08 GMT

Technology fingerprints

Envoy (Reverse proxies)
Nginx:1.28.2 (Web servers, Reverse proxies)
HSTS (Security)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /30d02cd80a5f0482ae8df9cffe081689/invoke.js HTTP/1.1
Host: creasereturndisplayed.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-Fetch-Storage-Access: none
Sec-GPC: 1
Connection: keep-alive
Referer: https://download.9mcstorage.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Priority: u=2
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Server: nginx/1.28.2
Date: Sun, 07 Jun 2026 15:43:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
accept-ch: Sec-CH-UA-Platform,Sec-CH-UA-Model,Device-Stock-UA,X-Device-User-Agent,X-OperaMini-Phone-UA,User-Agent,Sec-CH-UA,Sec-CH-UA-PlatformUser-Agent,Sec-CH-UA-Mobile,X-UCBrowser-Device-UA,Sec-CH-UA-Platform-Version,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List
access-control-allow-origin: *
content-encoding: zstd
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
vary: Accept-Encoding
x-envoy-upstream-service-time: 4
Host: creasereturndisplayed.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
X-Request-ID: f0aa34b04977e7ee6d2ed97cb6d0f461
Cache-Control: no-cache, max-age=0, private, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=0; includeSubdomains

15:43:59.520 GET 200 script 47.1 KB 953 ms 1 alerts

15:43:59.521 GET 200 script 47.0 KB 949 ms 1 alerts

15:43:59.597 GET 200 img 27.8 KB 47 ms —

15:43:59.598 GET 200 img 731 B 52 ms —

15:43:59.838 POST 204 beacon 0 B 162 ms 3 alerts

15:44:00.083 GET 200 xhr 40 B 110 ms —

15:44:00.217 GET 307 xhr 0 B 0 ms 1 alerts

15:44:00.488 GET 200 xhr 0 B 0 ms 1 alerts

15:44:00.495 GET 200 xhr 0 B 0 ms 1 alerts

15:44:00.699 GET 200 xhr 0 B 0 ms 1 alerts

15:44:00.924 GET 200 document 25.8 KB 96 ms —

15:44:00.937 POST 204 beacon 0 B 147 ms 3 alerts

15:44:00.939 GET No response img 0 B 0 ms 1 alerts

15:44:01.113 GET 200 stylesheet 6.8 KB 22 ms —

15:44:01.114 GET 200 script 243 B 21 ms —

15:44:01.119 GET 200 script 1.7 KB 20 ms —

15:44:01.120 GET 200 script 1.6 KB 20 ms —

15:44:01.122 GET 200 script 9.4 KB 23 ms —

15:44:01.123 GET 200 script 2.8 KB 23 ms —

15:44:01.128 GET 200 img 2.6 KB 20 ms —

15:44:01.130 GET 200 img 2.2 KB 20 ms —

15:44:01.135 GET 200 img 3.7 KB 20 ms —

15:44:01.136 GET 200 img 2.0 KB 20 ms —

15:44:01.137 GET 200 img 3.6 KB 21 ms —

15:44:01.138 GET 200 img 4.6 KB 22 ms —

15:44:01.139 GET 200 img 1.8 KB 22 ms —

15:44:01.140 GET 200 img 636 B 21 ms —

15:44:01.141 GET 200 img 492 B 21 ms —

15:44:01.142 GET 200 img 9.4 KB 24 ms —

15:44:01.143 GET 200 img 2.8 KB 23 ms —

15:44:01.156 POST 200 beacon 0 B 0 ms —

15:44:01.182 GET 200 script 5.0 KB 20 ms —

15:44:01.183 GET 200 script 6.8 KB 20 ms —

15:44:01.189 GET 200 script 6.4 KB 20 ms —

15:44:01.190 GET 200 script 2.6 KB 20 ms —

15:44:01.194 GET 200 script 2.0 KB 20 ms —

15:44:01.247 GET 200 fetch 529 B 20 ms —

15:44:01.275 POST 200 beacon 0 B 0 ms —

http://download.9mcstorage.com/dl2.php?file=Actions-and-Stuff-1.10.1.mcpack

Domain graph

Hostnames

Connections