WEBSITE ANALYSIS REPORT

http://h2tmz1.fxhqjzinf.com/

21 Jun 2026 · 07:37:07.000 UTCpublic

Report tags
Submit tags

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

13.212.103.981 captured requests
47.129.175.1271 captured requests
51cg1.com1 captured requests
52.221.252.1711 captured requests
54.169.217.471 captured requests
54.179.7.381 captured requests
54.255.167.203 captured requests
54.255.68.2131 captured requests
api-dc-prod-001.cyou1 captured requests
api-dc-prod-005.cyou1 captured requests
api-dc2-prod-01.cyou1 captured requests
api-dc2-prod-05.cyou1 captured requests
d3k4e7spixznr4.cloudfront.net2 captured requests
h2tmz1.fxhqjzinf.com59 captured requests
mc.yandex.com5 captured requests
mc.yandex.ru1 captured requests
pic.dsvhvu.cn93 captured requests
region1.analytics.google.com1 captured requests
stats.g.doubleclick.net1 captured requests
www.google.no1 captured requests
www.googletagmanager.com1 captured requests

Connections

h2tmz1.fxhqjzinf.com → 13.212.103.98Calls1 captured connections
h2tmz1.fxhqjzinf.com → 47.129.175.127Calls1 captured connections
h2tmz1.fxhqjzinf.com → 51cg1.comLoads from1 captured connections
h2tmz1.fxhqjzinf.com → 52.221.252.171Calls1 captured connections
h2tmz1.fxhqjzinf.com → 54.169.217.47Calls1 captured connections
h2tmz1.fxhqjzinf.com → 54.179.7.38Calls1 captured connections
h2tmz1.fxhqjzinf.com → 54.255.167.20Calls3 captured connections
h2tmz1.fxhqjzinf.com → 54.255.68.213Calls1 captured connections
h2tmz1.fxhqjzinf.com → api-dc-prod-001.cyouCalls1 captured connections
h2tmz1.fxhqjzinf.com → api-dc-prod-005.cyouCalls1 captured connections
h2tmz1.fxhqjzinf.com → api-dc2-prod-01.cyouCalls1 captured connections
h2tmz1.fxhqjzinf.com → api-dc2-prod-05.cyouCalls1 captured connections
h2tmz1.fxhqjzinf.com → d3k4e7spixznr4.cloudfront.netCalls2 captured connections
h2tmz1.fxhqjzinf.com → mc.yandex.comCalls4 captured connections
h2tmz1.fxhqjzinf.com → mc.yandex.comLoads from1 captured connections
h2tmz1.fxhqjzinf.com → mc.yandex.ruLoads from1 captured connections
h2tmz1.fxhqjzinf.com → pic.dsvhvu.cnCalls93 captured connections
h2tmz1.fxhqjzinf.com → region1.analytics.google.comCalls1 captured connections
h2tmz1.fxhqjzinf.com → stats.g.doubleclick.netCalls1 captured connections
h2tmz1.fxhqjzinf.com → www.google.noLoads from1 captured connections
h2tmz1.fxhqjzinf.com → www.googletagmanager.comLoads from1 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

07:36:22.952 GET 200 document 261.8 KB 74 ms 1 alerts

07:36:23.286 GET 200 stylesheet 2.9 KB 12 ms 1 alerts

07:36:23.287 GET 200 script 517.5 KB 155 ms —

07:36:23.290 GET 200 stylesheet 99.9 KB 13 ms 1 alerts

07:36:23.291 GET 200 stylesheet 197.9 KB 22 ms 1 alerts

07:36:23.292 GET 200 stylesheet 50.7 KB 21 ms 1 alerts

07:36:23.324 GET 200 stylesheet 74.9 KB 12 ms 1 alerts

07:36:23.325 GET 200 stylesheet 63.4 KB 14 ms 1 alerts

07:36:23.327 GET 200 stylesheet 15.6 KB 13 ms 1 alerts

07:36:23.329 GET 200 script 137.2 KB 14 ms 1 alerts

07:36:23.330 GET 200 script 83.6 KB 14 ms 1 alerts

07:36:23.332 GET 200 script 49.6 KB 12 ms 1 alerts

07:36:23.333 GET 200 script 4.1 KB 12 ms 1 alerts

07:36:23.337 GET 200 script 307.6 KB 15 ms 1 alerts

07:36:23.338 GET 200 script 284.5 KB 19 ms 1 alerts

07:36:23.340 GET 200 script 133.0 KB 19 ms 1 alerts

07:36:23.341 GET 200 script 19.5 KB 18 ms 1 alerts

07:36:23.343 GET 200 script 36.2 KB 18 ms 1 alerts

07:36:23.345 GET 200 script 593.5 KB 25 ms 1 alerts

07:36:23.347 GET 200 script 139.4 KB 24 ms 1 alerts

07:36:23.348 GET 200 script 19.8 KB 23 ms 1 alerts

07:36:23.350 GET 200 script 14.4 KB 22 ms 1 alerts

07:36:23.351 GET 200 script 38.3 KB 23 ms 1 alerts

07:36:23.352 GET 200 script 45.2 KB 22 ms 1 alerts

07:36:23.354 GET 200 script 42.9 KB 20 ms 1 alerts

07:36:23.372 GET 200 img 328 B 12 ms 1 alerts

07:36:23.374 GET 200 img 239 B 11 ms 1 alerts

07:36:23.375 GET 200 img 36.5 KB 12 ms 1 alerts

07:36:23.377 GET 200 img 660 B 11 ms 1 alerts

07:36:23.378 GET 200 img 311 B 11 ms 1 alerts

07:36:23.379 GET 200 img 630 B 11 ms 1 alerts

07:36:23.380 GET 200 img 624 B 11 ms 1 alerts

Transaction #69

Request / response

URL

GET HTTPS

https://h2tmz1.fxhqjzinf.com/usr/themes/Mirages/images/github.png

IP / ASN

65.9.46.6

Unknown

Requested by: https://h2tmz1.fxhqjzinf.com/

Resource information

File type: PNG image data, 84 x 84, 4-bit colormap, non-interlaced
MIME type: image/png
First seen (UTC): 26 Mar 2026 · 09:29:38.993 UTC
Last seen (UTC): 28 Sep 2026 · 07:57:55.737 UTC
Times seen: 11726

Size: 624 B (624 bytes)
MD5: 7eeb4e826318468dd09ffcd3713d4008
SHA1: e2907d62b39dd78deb8daaae30760f7e40f02123
SHA256: d1f426df6fa06fa7557522a8569969f1ab37f80995501527709460bd06a672e5

Certificate information

Issuer: Amazon · Amazon RSA 2048 M04
Subject: *.fxhqjzinf.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 9D:A8:22:C8:B1:EA:50:55:F2:B2:84:EB:E7:A4:8F:2D:7F:55:A2:8A
Valid from: Sat, 20 Jun 2026 00:00:00 GMT
Valid until: Sun, 03 Jan 2027 23:59:59 GMT

Technology fingerprints

Amazon CloudFront (CDN)
Amazon Web Services (PaaS)
Nginx:1.22.1 (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /usr/themes/Mirages/images/github.png HTTP/1.1
Host: h2tmz1.fxhqjzinf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://h2tmz1.fxhqjzinf.com/
Sec-GPC: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Priority: u=5, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 
content-type: image/png
content-length: 628
date: Sun, 21 Jun 2026 07:28:59 GMT
accept-ranges: bytes
access-control-allow-methods: GET, POST, HEAD, OPTIONS
access-control-allow-origin: *
server: nginx/1.22.1
x-p-r: 4ce8-77
content-encoding: br
last-modified: Thu, 26 Mar 2026 08:53:48 GMT
etag: "69c4f41c-270"
x-cache: Hit from cloudfront
via: 1.1 e140d2da7966a710ba00bef37e36e352.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN52-P1
x-amz-cf-id: _h6EnhLjqSS4Mo458BBpt1fM-m5smKH59WradDBGEzwnUGLDnqXToQ==
age: 444
X-Firefox-Spdy: h2

07:36:23.381 GET 200 img 688 B 13 ms 1 alerts

07:36:23.382 GET 200 img 754 B 11 ms 1 alerts

07:36:23.385 GET 200 img 537 B 11 ms 1 alerts

07:36:23.386 GET 200 img 36.5 KB 12 ms 1 alerts

07:36:23.387 GET 200 img 326 B 11 ms 1 alerts

07:36:23.389 GET 200 img 732 B 11 ms 1 alerts

07:36:23.390 GET 200 img 708 B 11 ms 1 alerts

07:36:23.392 GET 200 img 724 B 11 ms 1 alerts

07:36:23.393 GET 200 img 500 B 11 ms 1 alerts

07:36:23.394 GET 200 img 360 B 11 ms 1 alerts

07:36:23.396 GET 200 img 932 B 11 ms 1 alerts

07:36:23.396 GET 200 img 3.1 KB 14 ms 1 alerts

07:36:23.397 GET 200 img 951 B 12 ms 1 alerts

07:36:23.566 GET 200 xhr 136.2 KB 16869 ms —

07:36:23.568 GET 200 xhr 158.8 KB 31260 ms —

07:36:23.569 GET 200 xhr 14.9 KB 16906 ms —

07:36:23.572 GET 200 xhr 155.9 KB 32256 ms —

07:36:23.577 GET 200 font 75.4 KB 17 ms 1 alerts

http://h2tmz1.fxhqjzinf.com/

Domain graph

Hostnames

Connections

Network requests

Transaction #69

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://h2tmz1.fxhqjzinf.com/

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #69

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://h2tmz1.fxhqjzinf.com/

Domain graph

Network requests