| |  185.11.100.204 | 301 Moved Permanently | 240 B |
URL User Request GET HTTP/2IP185.11.100.204:443 ASN#29522 Cyber_Folks S.A.
CertificateIssuerLet's Encrypt Subjectbitly.ws Fingerprint2E:32:BE:AA:55:57:6D:B9:D0:4B:B5:E4:B8:69:A8:99:AF:37:26:88 ValidityThu, 02 May 2024 22:01:15 GMT - Wed, 31 Jul 2024 22:01:14 GMT
File typeHTML document, ASCII text Hashc27a3f6b78ba04534368d3fd19859346 2a139588c7e8d0c4ba34f1a495b7b0b25cf1390e 2bf613f4485182449618cf77230a42df6c56f5cf16627671bd59842676ffd9a8
GET /32ECJ HTTP/1.1
Host: bitly.ws
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Sat, 04 May 2024 02:20:08 GMT
server: Apache
location: https://bitly.ws/?redirect=32ECJ
cache-control: max-age=0
expires: Sat, 04 May 2024 02:20:08 GMT
content-length: 240
content-type: text/html; charset=iso-8859-1
X-Firefox-Spdy: h2
|
|
| zip.lu/js/adframe.js | 185.11.100.204 | 200 OK | 16 B |
IP185.11.100.204:443 ASN#29522 Cyber_Folks S.A.
CertificateIssuerLet's Encrypt Subjectzip.lu FingerprintBA:69:B8:76:30:88:C6:A1:75:27:5D:FB:93:55:75:0C:F7:FE:CB:36 ValiditySat, 20 Apr 2024 15:39:44 GMT - Fri, 19 Jul 2024 15:39:43 GMT
File typeASCII text, with no line terminators Hash760222d2e529d3e84eb01378cfc46e2e f789f3c0007640b5549fca2710cf3da500b95e86 0059cb4ff0a271382c38af8a7367aaf45cbeb31449637d3928d25317401e2828
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/adframe.js HTTP/1.1
Host: zip.lu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/?banned=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:09 GMT
server: Apache
last-modified: Sat, 30 Dec 2017 21:02:30 GMT
etag: "10-5619511402320"
accept-ranges: bytes
content-length: 16
cache-control: max-age=0
expires: Sat, 04 May 2024 02:20:09 GMT
content-type: application/javascript
X-Firefox-Spdy: h2
|
|
| zip.lu/css/style.css | 185.11.100.204 | 200 OK | 2.8 kB |
IP185.11.100.204:443 ASN#29522 Cyber_Folks S.A.
CertificateIssuerLet's Encrypt Subjectzip.lu FingerprintBA:69:B8:76:30:88:C6:A1:75:27:5D:FB:93:55:75:0C:F7:FE:CB:36 ValiditySat, 20 Apr 2024 15:39:44 GMT - Fri, 19 Jul 2024 15:39:43 GMT
File typeassembler source, Unicode text, UTF-8 text, with CRLF line terminators Hash4f01ddcf0e75cdacc7614891a0267ef0 cfeaf4c177b3033406ce9b5725c48be4b50fa066 b321e7e91fe1b3cf4c2f490cc83c6ef52585f23db09aeeb7a5e962f671663fd4
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /css/style.css HTTP/1.1
Host: zip.lu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/?banned=1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:09 GMT
server: Apache
last-modified: Sat, 20 Apr 2024 08:02:52 GMT
etag: "2d75-61682a18e99c0-gzip"
accept-ranges: bytes
cache-control: max-age=0
expires: Sat, 04 May 2024 02:20:09 GMT
vary: Accept-Encoding
content-encoding: gzip
content-length: 2777
content-type: text/css
X-Firefox-Spdy: h2
|
|
| zip.lu/gfx/bmac.png | 185.11.100.204 | 200 OK | 3.2 kB |
IP185.11.100.204:443 ASN#29522 Cyber_Folks S.A.
CertificateIssuerLet's Encrypt Subjectzip.lu FingerprintBA:69:B8:76:30:88:C6:A1:75:27:5D:FB:93:55:75:0C:F7:FE:CB:36 ValiditySat, 20 Apr 2024 15:39:44 GMT - Fri, 19 Jul 2024 15:39:43 GMT
File typePNG image data, 214 x 60, 8-bit colormap, non-interlaced Hash781860bb7eb619aa3b173144c6d29646 6ba3a103709f121cf9f5ab214610d0215dab93e9 54339f1c8cb089c05773b2b18fd5da6e702956decbf7dea6ef0348a64203c657
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /gfx/bmac.png HTTP/1.1
Host: zip.lu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/?banned=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:09 GMT
server: Apache
last-modified: Sat, 19 Aug 2023 15:45:47 GMT
etag: "c86-6034889f203e4"
accept-ranges: bytes
content-length: 3206
cache-control: max-age=31536000
expires: Sun, 04 May 2025 02:20:09 GMT
content-type: image/png
X-Firefox-Spdy: h2
|
|
| www.paypalobjects.com/pl_PL/i/scr/pixel.gif |  192.229.221.25 | 200 OK | 43 B |
URL GET HTTP/2www.paypalobjects.com/pl_PL/i/scr/pixel.gif IP192.229.221.25:443
CertificateIssuerDigiCert Inc Subjectwww.paypal.com Fingerprint4B:C0:E1:F0:16:B3:A4:B3:63:08:41:DF:F2:EF:8D:65:54:1D:30:B1 ValidityThu, 12 Oct 2023 00:00:00 GMT - Thu, 31 Oct 2024 23:59:59 GMT
File typeGIF image data, version 89a, 1 x 1 Hashfc94fb0c3ed8a8f909dbc7630a0987ff 56d45f8a17f5078a20af9962c992ca4678450765 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
GET /pl_PL/i/scr/pixel.gif HTTP/1.1
Host: www.paypalobjects.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
cache-control: s-maxage=31536000, public,max-age=3600
content-type: image/gif
date: Sat, 04 May 2024 02:20:09 GMT
dc: ccg11-origin-www-1.paypal.com
etag: "5d5637c5-2b"
expires: Sat, 04 May 2024 03:20:09 GMT
last-modified: Fri, 16 Aug 2019 04:57:41 GMT
paypal-debug-id: 2b5a4d618fa0a
server: ECAcc (ska/F6B7)
strict-transport-security: max-age=63072000; includeSubDomains; preload
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
traceparent: 00-00000000000000000002b5a4d618fa0a-1ee1f9b462072736-01
x-cache: HIT
x-content-type-options: nosniff
content-length: 43
X-Firefox-Spdy: h2
|
|
| zip.lu/gfx/ziplu-chart.png | 185.11.100.204 | 200 OK | 2.0 kB |
URL GET HTTP/2zip.lu/gfx/ziplu-chart.png IP185.11.100.204:443 ASN#29522 Cyber_Folks S.A.
CertificateIssuerLet's Encrypt Subjectzip.lu FingerprintBA:69:B8:76:30:88:C6:A1:75:27:5D:FB:93:55:75:0C:F7:FE:CB:36 ValiditySat, 20 Apr 2024 15:39:44 GMT - Fri, 19 Jul 2024 15:39:43 GMT
File typePNG image data, 1200 x 1200, 2-bit colormap, non-interlaced Hash0ce170cef8f689ab343636f7e8683808 ef2e58ee55b2ebeb24fd3d9a0d11a6495e36ecc2 c982e300b4c5093be2adaa79428c053dff57ea90ef4f93e3cf2633a680685d03
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /gfx/ziplu-chart.png HTTP/1.1
Host: zip.lu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/?banned=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:09 GMT
server: Apache
last-modified: Wed, 24 Apr 2024 17:59:41 GMT
etag: "7cd-616db6f4dc1f1"
accept-ranges: bytes
content-length: 1997
cache-control: max-age=31536000
expires: Sun, 04 May 2025 02:20:09 GMT
content-type: image/png
X-Firefox-Spdy: h2
|
|
| zip.lu/gfx/adsterra2.png | 185.11.100.204 | 200 OK | 15 kB |
IP185.11.100.204:443 ASN#29522 Cyber_Folks S.A.
CertificateIssuerLet's Encrypt Subjectzip.lu FingerprintBA:69:B8:76:30:88:C6:A1:75:27:5D:FB:93:55:75:0C:F7:FE:CB:36 ValiditySat, 20 Apr 2024 15:39:44 GMT - Fri, 19 Jul 2024 15:39:43 GMT
File typePNG image data, 200 x 200, 8-bit colormap, non-interlaced Hash5d4aab7e8b7267e1876143c7bd308318 5e1827fa8442e7b1e06cfbdec4c52bdec22c9063 f9b415d80dc86d44446a312e855460fb4ac16207f5b2caa0620e69013598bde6
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /gfx/adsterra2.png HTTP/1.1
Host: zip.lu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/?banned=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:09 GMT
server: Apache
last-modified: Sat, 30 Mar 2024 10:55:14 GMT
etag: "3ba2-614de974dba8f"
accept-ranges: bytes
content-length: 15266
cache-control: max-age=31536000
expires: Sun, 04 May 2025 02:20:09 GMT
content-type: image/png
X-Firefox-Spdy: h2
|
|
| zip.lu/gfx/stripe.png | 185.11.100.204 | 200 OK | 1.4 kB |
IP185.11.100.204:443 ASN#29522 Cyber_Folks S.A.
CertificateIssuerLet's Encrypt Subjectzip.lu FingerprintBA:69:B8:76:30:88:C6:A1:75:27:5D:FB:93:55:75:0C:F7:FE:CB:36 ValiditySat, 20 Apr 2024 15:39:44 GMT - Fri, 19 Jul 2024 15:39:43 GMT
File typePNG image data, 91 x 60, 8-bit colormap, non-interlaced Hash17aaa9dc48a895306b06de8ae9a8b104 f75e086497b3743ac83d85dc4ca456e8bb556e55 b8214bd5cbd9197f329d1df98d908dc7a1cd38c28e8010b92e49b3f35dd9986a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /gfx/stripe.png HTTP/1.1
Host: zip.lu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/?banned=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:09 GMT
server: Apache
last-modified: Sat, 19 Aug 2023 15:45:50 GMT
etag: "54f-603488a24201d"
accept-ranges: bytes
content-length: 1359
cache-control: max-age=31536000
expires: Sun, 04 May 2025 02:20:09 GMT
content-type: image/png
X-Firefox-Spdy: h2
|
|
| www.googletagmanager.com/gtag/js?id=G-8Q1W6PKNCX | 142.250.74.136 | 200 OK | 88 kB |
URL GET HTTP/2www.googletagmanager.com/gtag/js?id=G-8Q1W6PKNCX IP142.250.74.136:443
CertificateIssuerGoogle Trust Services LLC Subject*.google-analytics.com Fingerprint93:6B:D2:9D:92:BE:2D:D8:02:67:82:83:5E:EF:A3:F9:13:F3:26:AE ValidityTue, 16 Apr 2024 03:18:45 GMT - Tue, 09 Jul 2024 03:18:44 GMT
File typeJavaScript source, ASCII text, with very long lines (5955) Hash5613b9698fea2a7efa8014b9074f1aec b989ef8aad022a337a8c27f5dad60b5f86844bfa 91ebd74ae08992d2a50ef57749e539139b54da2e623d45b625c14b770d1f9a79
GET /gtag/js?id=G-8Q1W6PKNCX HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 04 May 2024 02:20:09 GMT
expires: Sat, 04 May 2024 02:20:09 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 87664
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| zip.lu/gfx/paypal.png | 185.11.100.204 | 200 OK | 5.5 kB |
IP185.11.100.204:443 ASN#29522 Cyber_Folks S.A.
CertificateIssuerLet's Encrypt Subjectzip.lu FingerprintBA:69:B8:76:30:88:C6:A1:75:27:5D:FB:93:55:75:0C:F7:FE:CB:36 ValiditySat, 20 Apr 2024 15:39:44 GMT - Fri, 19 Jul 2024 15:39:43 GMT
File typePNG image data, 200 x 150, 8-bit colormap, non-interlaced Hash164e7543a819062962815f4bd99b8419 0355f9dad012daa6adf4bae4e47e44d4b2c51888 675f6b6dc673aae01f8ef949697ee544c8df8574ca090a4dd690776ec6e442ea
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /gfx/paypal.png HTTP/1.1
Host: zip.lu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/?banned=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:09 GMT
server: Apache
last-modified: Tue, 02 Jan 2018 13:00:54 GMT
etag: "158c-561cab06562ce"
accept-ranges: bytes
content-length: 5516
cache-control: max-age=31536000
expires: Sun, 04 May 2025 02:20:09 GMT
content-type: image/png
X-Firefox-Spdy: h2
|
|
| zip.lu/gfx/paypal.jpg | 185.11.100.204 | 200 OK | 8.7 kB |
IP185.11.100.204:443 ASN#29522 Cyber_Folks S.A.
CertificateIssuerLet's Encrypt Subjectzip.lu FingerprintBA:69:B8:76:30:88:C6:A1:75:27:5D:FB:93:55:75:0C:F7:FE:CB:36 ValiditySat, 20 Apr 2024 15:39:44 GMT - Fri, 19 Jul 2024 15:39:43 GMT
File typePNG image data, 380 x 130, 8-bit colormap, non-interlaced Hasheeb10183dfe4b9ec6bcfea9aa6fa07f6 b55d89bc1ead011821dd3371f2885996fe99785a 1ae6619173f92af4f0201b7204322213c714b56df437aa7d6482a1c141d5337c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /gfx/paypal.jpg HTTP/1.1
Host: zip.lu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/?banned=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:09 GMT
server: Apache
last-modified: Tue, 02 Jan 2018 13:00:56 GMT
etag: "2204-561cab086d14b"
accept-ranges: bytes
content-length: 8708
cache-control: max-age=31536000
expires: Sun, 04 May 2025 02:20:09 GMT
content-type: image/jpeg
X-Firefox-Spdy: h2
|
|
| | 185.11.100.204 | 200 OK | 15 kB |
URL User Request GET HTTP/2IP185.11.100.204:443 ASN#29522 Cyber_Folks S.A.
CertificateIssuerLet's Encrypt Subjectzip.lu FingerprintBA:69:B8:76:30:88:C6:A1:75:27:5D:FB:93:55:75:0C:F7:FE:CB:36 ValiditySat, 20 Apr 2024 15:39:44 GMT - Fri, 19 Jul 2024 15:39:43 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (26595), with CRLF line terminators Hash570240f97fab7e6c25f03df0264738cf 2483570a9808efa3e74999a56f4c0cb1d7e63188 da751ebbeb51be9d07070ca95846ca253c0fb2182187b9887864480cc59e21e4
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /?banned=1 HTTP/1.1
Host: zip.lu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:09 GMT
server: Apache
x-powered-by: PHP/5.5.38
cache-control: max-age=0
expires: Sat, 04 May 2024 02:20:09 GMT
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
X-Firefox-Spdy: h2
|
|
| www.topcreativeformat.com/6dc3a27552b5aedfb96aeaa00aa1c37b/invoke.js | 172.240.108.76 | 200 OK | 12 kB |
URL GET HTTP/1.1www.topcreativeformat.com/6dc3a27552b5aedfb96aeaa00aa1c37b/invoke.js IP172.240.108.76:443
CertificateIssuerLet's Encrypt Subjecttopcreativeformat.com Fingerprint6D:98:D9:61:FC:CF:D9:8C:FE:5E:1C:15:5A:A5:F2:28:38:04:A4:A4 ValidityWed, 20 Mar 2024 07:51:41 GMT - Tue, 18 Jun 2024 07:51:40 GMT
File typeJavaScript source, ASCII text, with very long lines (31292), with no line terminators Hash3c05350bb17cb422beb56737bb49548d 9078037bb17cf9fb398d7317ce9f16391d984b4d e28e30caccdf7eb1d57d076fc2824cc904418c824f6eec86eebf22944be4a449
GET /6dc3a27552b5aedfb96aeaa00aa1c37b/invoke.js HTTP/1.1
Host: www.topcreativeformat.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 04 May 2024 02:20:10 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 9add2e4bb54f35821a2ee4ce76739db1
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| ocsp.r2m03.amazontrust.com/ | 3.164.222.26 | | 471 B |
URL ocsp.r2m03.amazontrust.com/ IP3.164.222.26:0
Hash353dbae1e1b45a750770ae51bef13ba7 465917a2a0bbb947e9727e7f08b584a82aa6fb81 9fa5becc3e07f31f2f08bf5f331d6bfda4f6386634ea524bc3a8c56ac1c0bc2b
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sat, 04 May 2024 02:20:10 GMT
Last-Modified: Sat, 04 May 2024 01:51:00 GMT
Server: ECAcc (ska/F775)
X-Cache: Miss from cloudfront
Via: 1.1 3ed36d9549564152ef96812502a86608.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ARN53-P1
X-Amz-Cf-Id: 2JFA6Jq4MFKh2stRXU9qPpMNKjKOG8Us2UsGIKq6AQXk-PPq0jlW4Q==
Age: 1750
|
|
| ocsp.r2m03.amazontrust.com/ | 3.164.222.26 | | 471 B |
URL ocsp.r2m03.amazontrust.com/ IP3.164.222.26:0
Hash353dbae1e1b45a750770ae51bef13ba7 465917a2a0bbb947e9727e7f08b584a82aa6fb81 9fa5becc3e07f31f2f08bf5f331d6bfda4f6386634ea524bc3a8c56ac1c0bc2b
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sat, 04 May 2024 02:20:10 GMT
Last-Modified: Sat, 04 May 2024 01:24:05 GMT
Server: ECAcc (ska/F757)
X-Cache: Miss from cloudfront
Via: 1.1 e2b910126831841c6bf3d6563742ab92.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ARN53-P1
X-Amz-Cf-Id: ResmSd9jPIdB5uXTGK8W8wLTr3UhxCpn2J0tOAyznWMqZcz5VK53Pg==
Age: 3366
|
|
| www.topcreativeformat.com/fb87135eb1bdee211d55a6d31f28b1bc/invoke.js | 172.240.108.76 | 200 OK | 12 kB |
URL GET HTTP/1.1www.topcreativeformat.com/fb87135eb1bdee211d55a6d31f28b1bc/invoke.js IP172.240.108.76:443
CertificateIssuerLet's Encrypt Subjecttopcreativeformat.com Fingerprint6D:98:D9:61:FC:CF:D9:8C:FE:5E:1C:15:5A:A5:F2:28:38:04:A4:A4 ValidityWed, 20 Mar 2024 07:51:41 GMT - Tue, 18 Jun 2024 07:51:40 GMT
File typeJavaScript source, ASCII text, with very long lines (31331), with no line terminators Hash8dfbb38aa4573948c4d27f227ab36ea4 94b4ded9a810162f4f7dd0958cb1370febbbbf7c 147bc522dda05e6beee02342db9ad3edfd6640ad97485714ec8c610937965259
GET /fb87135eb1bdee211d55a6d31f28b1bc/invoke.js HTTP/1.1
Host: www.topcreativeformat.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 04 May 2024 02:20:10 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: f6f23b5f6bfbc0f06d893d43ad175366
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| landings-cdn.adsterratech.com/referralBanners/png/300%20x%20250%20px.png | 142.0.204.220 | 200 OK | 90 kB |
URL GET HTTP/1.1landings-cdn.adsterratech.com/referralBanners/png/300%20x%20250%20px.png IP142.0.204.220:443
CertificateIssuerLet's Encrypt Subjectlandings-cdn.adsterratech.com FingerprintCA:79:50:AF:4F:E1:B9:4D:FD:EE:28:B7:AD:6C:21:7A:99:D2:DB:93 ValiditySun, 28 Apr 2024 07:09:01 GMT - Sat, 27 Jul 2024 07:09:00 GMT
File typePNG image data, 300 x 250, 8-bit/color RGBA, non-interlaced Hasha28902cd41b26954be2c97eea41089a1 c69d00be80adbcba05b788d2dcf7967d0d15a65f 5b4fa649af59a8350f401a661a5ecfed92130aa0aa9825ac3777c2a893a96e61
GET /referralBanners/png/300%20x%20250%20px.png HTTP/1.1
Host: landings-cdn.adsterratech.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 04 May 2024 02:20:10 GMT
Content-Type: image/png
Content-Length: 90409
Last-Modified: Wed, 02 Feb 2022 00:50:11 GMT
Connection: keep-alive
ETag: "61f9d543-16129"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Date
Cache-Control: max-age=315360000, public
Accept-Ranges: bytes
|
|
| proftrafficcounter.com/stats |  18.185.9.67 | 200 OK | 40 B |
URL GET HTTP/2proftrafficcounter.com/stats IP18.185.9.67:443
CertificateIssuerAmazon Subjectproftrafficcounter.com FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6 ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File typeASCII text, with no line terminators Hash1b250dc5127a11a44489f7de919a75a1 a72ddee4709f0900e05bdfdf0c4e1f679859a702 6752fec9528eacb8754d5397d185c22eca6a4fb40054aee77fdf6ae4ea80f0b3
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zip.lu
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:10 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://zip.lu
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=2f625561-0ed1-46be-8d8e-eae933551b29:1:1; expires=Tue, 02 May 2034 02:20:10 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
|
|
| proftrafficcounter.com/stats | 18.185.9.67 | 200 OK | 40 B |
URL GET HTTP/2proftrafficcounter.com/stats IP18.185.9.67:443
CertificateIssuerAmazon Subjectproftrafficcounter.com FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6 ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File typeASCII text, with no line terminators Hash4bcbb9900b681bfc400fe3c4e046f045 9893b1b459fe708225b582b472d42a6872b20564 891c91ceb7c7622a7dd494357b626035e590ca3f0886078b166ceae6028fef4f
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zip.lu
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:10 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://zip.lu
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=fbbf0c59-587c-4857-b0d9-a1ebcf1b13b6:3:1; expires=Tue, 02 May 2034 02:20:10 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
|
|
| proftrafficcounter.com/stats | 18.185.9.67 | 200 OK | 40 B |
URL GET HTTP/2proftrafficcounter.com/stats IP18.185.9.67:443
CertificateIssuerAmazon Subjectproftrafficcounter.com FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6 ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File typeASCII text, with no line terminators Hasheefbfe6968af313ec4826a3ba35a1b3b dad5ab99273a0d6e71ac866d3b8cae3a87d7b8dd 35dbba9ede91ec42d516937612e61162ed85e428b1bdd2b240b16a99fef7edc9
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zip.lu
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:10 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://zip.lu
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=618d663e-f8d5-4c45-a0b2-22a33ee384d6:1:1; expires=Tue, 02 May 2034 02:20:10 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
|
|
| zip.lu/gfx/favicon.png | 185.11.100.204 | 200 OK | 2.0 kB |
IP185.11.100.204:443 ASN#29522 Cyber_Folks S.A.
CertificateIssuerLet's Encrypt Subjectzip.lu FingerprintBA:69:B8:76:30:88:C6:A1:75:27:5D:FB:93:55:75:0C:F7:FE:CB:36 ValiditySat, 20 Apr 2024 15:39:44 GMT - Fri, 19 Jul 2024 15:39:43 GMT
File typePNG image data, 48 x 48, 8-bit colormap, non-interlaced Hash549c8f6c3f6b1340852212e7c784d187 e8fe075cef3bf487bd9e4e89e9b4a6b63a81e0cc 00495e504ff3e4604b6404a1ae9469f40bd4642bef08239d4d0b0b83c095f590
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /gfx/favicon.png HTTP/1.1
Host: zip.lu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/?banned=1
Cookie: _ga_8Q1W6PKNCX=GS1.1.1714789210.1.0.1714789210.0.0.0; _ga=GA1.1.7691736.1714789210; dom3ic8zudi28v8lr6fgphwffqoz0j6c=618d663e-f8d5-4c45-a0b2-22a33ee384d6%3A1%3A1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:11 GMT
server: Apache
last-modified: Tue, 02 Apr 2024 12:49:39 GMT
etag: "7b5-6151c8a0cb469"
accept-ranges: bytes
content-length: 1973
cache-control: max-age=31536000
expires: Sun, 04 May 2025 02:20:11 GMT
content-type: image/png
X-Firefox-Spdy: h2
|
|
| lodgesweet.com/78/66/ea/7866ead300fcf9e425beaf01fe308949.js | 172.240.108.76 | 200 OK | 30 kB |
URL GET HTTP/1.1lodgesweet.com/78/66/ea/7866ead300fcf9e425beaf01fe308949.js IP172.240.108.76:443
CertificateIssuerLet's Encrypt Subjectlodgesweet.com Fingerprint4B:E6:E5:18:A7:CE:25:B5:28:0A:7D:6A:20:3C:0D:DB:99:06:5D:46 ValidityMon, 29 Apr 2024 08:45:06 GMT - Sun, 28 Jul 2024 08:45:05 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash3fff8688a7dc6c91e631408213e3e938 a2cd570de72c486876845bd564d4999cd455ce3d 276b98f2f80d77b7fe1c26384f74da34424d3bf8cf5ab267aa9727e9b7a29978
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /78/66/ea/7866ead300fcf9e425beaf01fe308949.js HTTP/1.1
Host: lodgesweet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 04 May 2024 02:20:10 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: fc6c0330e76f10748f5a8aa57448e2e4
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| lodgesweet.com/ntv.json?key=172d9680245553e8052aafbe1bd64a13&vstc=4 | 172.240.108.76 | 200 OK | 17 kB |
URL GET HTTP/1.1lodgesweet.com/ntv.json?key=172d9680245553e8052aafbe1bd64a13&vstc=4 IP172.240.108.76:443
CertificateIssuerLet's Encrypt Subjectlodgesweet.com Fingerprint4B:E6:E5:18:A7:CE:25:B5:28:0A:7D:6A:20:3C:0D:DB:99:06:5D:46 ValidityMon, 29 Apr 2024 08:45:06 GMT - Sun, 28 Jul 2024 08:45:05 GMT
Hash2329fc13530f85d73e6ebbcc425362f7 41f3579b6d59ae9da444036e601479f2c7d3d77e 0630eea57c7f193a8c47d3dd52345ad9e42c65c72b565da4b10f7b8c24d588d7
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ntv.json?key=172d9680245553e8052aafbe1bd64a13&vstc=4 HTTP/1.1
Host: lodgesweet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zip.lu
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Type: application/json
Content-Length: 17046
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zip.lu
Access-Control-Allow-Origin: https://zip.lu
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=22725681; expires=Sun, 05 May 2024 02:20:10 GMT; secure; SameSite=None
pdhtkv=true; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
uncs=1; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
pdhtkv49=true; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
uncs49=1; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
nlec172d9680245553e8052aafbe1bd64a13=[2229329,2229337,2229333,2019380]; expires=Sat, 04 May 2024 02:20:16 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: cc71c72abedeca20088c580fbf77c798
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| traditionallyrecipepiteous.com/watch.650614696272.js?key=fb87135eb1bdee211d55a6d31f28b1bc&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&tz=0&dev=e&res=14.2071&uuid=618d663e-f8d5-4c45-a0b2-22a33ee384d6%3A1%3A1 | 172.240.108.76 | 307 Temporary Redirect | 0 B |
URL GET HTTP/1.1traditionallyrecipepiteous.com/watch.650614696272.js?key=fb87135eb1bdee211d55a6d31f28b1bc&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&tz=0&dev=e&res=14.2071&uuid=618d663e-f8d5-4c45-a0b2-22a33ee384d6%3A1%3A1 IP172.240.108.76:443
CertificateIssuerLet's Encrypt Subjecttraditionallyrecipepiteous.com FingerprintC5:96:CF:B1:E4:A5:34:EC:37:89:CA:97:7E:35:7C:5C:00:54:6D:92 ValidityMon, 29 Apr 2024 13:00:48 GMT - Sun, 28 Jul 2024 13:00:47 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /watch.650614696272.js?key=fb87135eb1bdee211d55a6d31f28b1bc&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&tz=0&dev=e&res=14.2071&uuid=618d663e-f8d5-4c45-a0b2-22a33ee384d6%3A1%3A1 HTTP/1.1
Host: traditionallyrecipepiteous.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zip.lu
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.21.6
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zip.lu
Access-Control-Allow-Origin: https://zip.lu
Access-Control-Allow-Credentials: true
Location: https://traditionallyrecipepiteous.com/watch.650614696272.js?dev=e&key=fb87135eb1bdee211d55a6d31f28b1bc&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&pst=1714789271&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&res=14.2071&rmtc=t&shu=55b499db356b9d4e6ee64d7eb80d0df99fb35774d265a7ebb9d3be33ad6b80f18bc039e677e026ab6c432861b5ceac161f0e6a66be04a164e8e53d5baa9e3f88d787ed203d11d19bbe596cefe8b090c27d2da97dfd86972699c3f818952c&tz=0&uuid=618d663e-f8d5-4c45-a0b2-22a33ee384d6%3A1%3A1
Set-Cookie: u_pl=22829219; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMjgyOTIxOSwiayI6ImZiODcxMzVlYjFiZGVlMjExZDU1YTZkMzFmMjhiMWJjIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjozNjc1ODY4LCJwaWQiOjkzMDg4LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjM0LCJhaWQiOjMyLCJwdCI6NCwicGsiOiJ6YXM3dzFtanQiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6Nzk5NTQxOTYsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjoxODExMCwib24iOiJMaW51eCIsIm92IjoiVW5rbm93biIsImJpZCI6MTE2NjcwLCJibiI6IkZpcmVmb3giLCJidiI6Ijk2LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly96aXAubHUvP2Jhbm5lZD0xIiwiYXIiOltdfX0.x4V-YbMaz28DxGpGZqZohRewgpsltxYPfC_5fIrdH0Y; expires=Sat, 04 May 2024 02:21:11 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: b333513a33e1c06ecf67a972128d52fe
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| enraptureshut.com/watch.1358517985717.js?key=6dc3a27552b5aedfb96aeaa00aa1c37b&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&tz=0&dev=e&res=14.2071&uuid=fbbf0c59-587c-4857-b0d9-a1ebcf1b13b6%3A3%3A1 | 192.243.59.12 | 307 Temporary Redirect | 0 B |
URL GET HTTP/1.1enraptureshut.com/watch.1358517985717.js?key=6dc3a27552b5aedfb96aeaa00aa1c37b&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&tz=0&dev=e&res=14.2071&uuid=fbbf0c59-587c-4857-b0d9-a1ebcf1b13b6%3A3%3A1 IP192.243.59.12:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjectenraptureshut.com Fingerprint1D:09:0B:4D:F8:08:58:15:8B:41:5A:C9:BA:21:61:3A:BF:2F:54:96 ValidityMon, 29 Apr 2024 08:19:25 GMT - Sun, 28 Jul 2024 08:19:24 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /watch.1358517985717.js?key=6dc3a27552b5aedfb96aeaa00aa1c37b&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&tz=0&dev=e&res=14.2071&uuid=fbbf0c59-587c-4857-b0d9-a1ebcf1b13b6%3A3%3A1 HTTP/1.1
Host: enraptureshut.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zip.lu
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zip.lu
Access-Control-Allow-Origin: https://zip.lu
Access-Control-Allow-Credentials: true
Location: https://enraptureshut.com/watch.1358517985717.js?dev=e&key=6dc3a27552b5aedfb96aeaa00aa1c37b&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&pst=1714789271&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&res=14.2071&rmtc=t&shu=5977dab582a9bed8b81a67b21859682164cbc95a71579d4578cd2d91c200879dd9ff8c5b2196274c36e3cf71fd79264b8d100f913aee4011f973e60739cd5126eb3665e28fda85a1da32741835d2549286d3f05b8234aaac22a41482bb794e&tz=0&uuid=fbbf0c59-587c-4857-b0d9-a1ebcf1b13b6%3A3%3A1
Set-Cookie: u_pl=22735548; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMjczNTU0OCwiayI6IjZkYzNhMjc1NTJiNWFlZGZiOTZhZWFhMDBhYTFjMzdiIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjozNjc1ODY4LCJwaWQiOjkzMDg4LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjM0LCJhaWQiOjUsInB0Ijo0LCJwayI6Inc3cTYxZHZqbWUiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6Nzk5NTQxOTYsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjoxODExMCwib24iOiJMaW51eCIsIm92IjoiVW5rbm93biIsImJpZCI6MTE2NjcwLCJibiI6IkZpcmVmb3giLCJidiI6Ijk2LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly96aXAubHUvP2Jhbm5lZD0xIiwiYXIiOltdfX0.Wlik0i7U6TMsAzL1Ct4uONsIP4EB7gWVCej1azy-STE; expires=Sat, 04 May 2024 02:21:11 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: bb4dc4f40be9a6479480ea1abc8ab6d8
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| fundingchoicesmessages.google.com/i/pub-2614556310778759?ers=1 | 142.250.74.142 | 200 OK | 9.6 kB |
URL GET HTTP/2fundingchoicesmessages.google.com/i/pub-2614556310778759?ers=1 IP142.250.74.142:443
CertificateIssuerGoogle Trust Services LLC Subject*.google.com Fingerprint7C:B7:E1:97:03:6E:82:B6:52:F8:EC:C6:C6:50:D9:DD:80:47:E6:A0 ValidityTue, 16 Apr 2024 03:18:53 GMT - Tue, 09 Jul 2024 03:18:52 GMT
File typegzip compressed data, max compression Hash9c6a68f7c094f5240b888e6b078626f7 ca6ba77a62d2d3997df08ad00dbe650e7bad3d2e e6bba42e0479f74ffbcb2692eb518a5253b88cb65e9e0c0b308b70fea36dc7fe
GET /i/pub-2614556310778759?ers=1 HTTP/1.1
Host: fundingchoicesmessages.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 04 May 2024 02:20:11 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'nonce-cKWFZV6GyZGqp_y9RC86fQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cross-origin-opener-policy: same-origin
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw1JBiOO90h-k6ENcyPGNqBWIDjedMFkAs8fUlkxYQxzyfzpoCxE7pM1hDgNinfgZrHBC33jzHOh2ITy44z3oRiJP-nWctAeKdiy-wHgRiIW6O29uubWQTaOg-5wYATFEvEg"
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| lodgesweet.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSTWskRRiuXue0XvxYvAgyLAgKMunumemZcZFgjFmCcbMfLn4dpLqrZ1JOdVdT1TU9GS%2FBBdnjHLyol8ozyQY1LPoDXGQSWCQoZi4S0IA%2FwJOweJQeg9EX6v2o5y143vepT7bNKfFh6Mnym3LEhaALzZpbfeEdz7tSXeOpGVaH7eCDoHGlqgYvd4Ka%2B2L1ahz15YLveq7ruV51hau4K4cLJQie7Xe8WsetNfya12xgqP5fa%2BNAUwdscEqeAmezyqFzCTyaIk2%2BWY51P5fZS68nRtBcKgzY3u20n8oiRXKedpWDbrp31g2pj1ceQKa7c7qQg38bQz4jzsMHCNO9M5IIBztznqFAnCJkj6MYTBGLKTidIpJ3wNkxASKGa%2BtIk3vXpCro5j8oLdEZqTz6E7yYkcpvl5Am95cEH1ZvSWFyLlONYdeCD6fgvSkyc4B8dAG8OECUfwzOfiILj9aQJjvrWkhwZuezcz4F704h4jGodmDKwx2YrgOTOUjYSTXyPK%2Flsoi67U4U1VkrDgPmerTV9ajnBm2YqKQ3Rp6NEYkxIrWFTG2hz8dQ5nvoDQvNHOh8RpwbWxgwiyImKDRBQQkKTlDkBMXA7jKhfW3vMaFN6J1F%2FyzW7UTmvW26K%2FNenBJQNYZidjs7JU%2BW%2B3HeO%2FTQj0%2BqXstnnaDt%2Bo1ms1mP227Tp7Qbxl7Iggb16tDcgusL85FHfEbaz%2FyKrNSsbxHSA2hxgIhfBjUeaGFBNyxG6X7O002jRC2RIQeTFlleQb7pbItT8uxcocuVG4ijo8WHF1%2FJJr9cRKQsMmXxIT8k6Im7k5uyIDs3ZaHJt%2BtZzhM%2BoqV6t3Kax4999Ua8WUjFVpf1%2BMtXoxIo0%2F23Yp2v0ZTxtKfJ10ucsVitSBXF5LtV%2FXYcXjd6Y8mo1GRr119bWU0yFWvNZToF5cfrfyHiM1J5%2Fun5t3zixz%2FA1RTKWCTmiJwZuDxAlG1BZ0eL%2Bej3q%2FcvfQQtCZQ47wkzB4WxE%2BWH55eCE4j4vKahhf5PHZ7nE0XL15TbbX0XPVUBze8gTSwGymIgLKgYQ5uLkzxTR4s%2FfFba5whFZRIKVdkJhRKfzpdcundLd3tGnvu5Ac1Pqq163aVBp%2Bm1WjRuhQ2%2F3Q08RqnfCPwgoHXketZtfvH%2B3wAAAP%2F%2FAQAA%2F%2F%2F%2F5yLregQAAA%3D%3D | 172.240.108.76 | 200 OK | 7 B |
URL GET HTTP/1.1lodgesweet.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSTWskRRiuXue0XvxYvAgyLAgKMunumemZcZFgjFmCcbMfLn4dpLqrZ1JOdVdT1TU9GS%2FBBdnjHLyol8ozyQY1LPoDXGQSWCQoZi4S0IA%2FwJOweJQeg9EX6v2o5y143vepT7bNKfFh6Mnym3LEhaALzZpbfeEdz7tSXeOpGVaH7eCDoHGlqgYvd4Ka%2B2L1ahz15YLveq7ruV51hau4K4cLJQie7Xe8WsetNfya12xgqP5fa%2BNAUwdscEqeAmezyqFzCTyaIk2%2BWY51P5fZS68nRtBcKgzY3u20n8oiRXKedpWDbrp31g2pj1ceQKa7c7qQg38bQz4jzsMHCNO9M5IIBztznqFAnCJkj6MYTBGLKTidIpJ3wNkxASKGa%2BtIk3vXpCro5j8oLdEZqTz6E7yYkcpvl5Am95cEH1ZvSWFyLlONYdeCD6fgvSkyc4B8dAG8OECUfwzOfiILj9aQJjvrWkhwZuezcz4F704h4jGodmDKwx2YrgOTOUjYSTXyPK%2Flsoi67U4U1VkrDgPmerTV9ajnBm2YqKQ3Rp6NEYkxIrWFTG2hz8dQ5nvoDQvNHOh8RpwbWxgwiyImKDRBQQkKTlDkBMXA7jKhfW3vMaFN6J1F%2FyzW7UTmvW26K%2FNenBJQNYZidjs7JU%2BW%2B3HeO%2FTQj0%2BqXstnnaDt%2Bo1ms1mP227Tp7Qbxl7Iggb16tDcgusL85FHfEbaz%2FyKrNSsbxHSA2hxgIhfBjUeaGFBNyxG6X7O002jRC2RIQeTFlleQb7pbItT8uxcocuVG4ijo8WHF1%2FJJr9cRKQsMmXxIT8k6Im7k5uyIDs3ZaHJt%2BtZzhM%2BoqV6t3Kax4999Ua8WUjFVpf1%2BMtXoxIo0%2F23Yp2v0ZTxtKfJ10ucsVitSBXF5LtV%2FXYcXjd6Y8mo1GRr119bWU0yFWvNZToF5cfrfyHiM1J5%2Fun5t3zixz%2FA1RTKWCTmiJwZuDxAlG1BZ0eL%2Bej3q%2FcvfQQtCZQ47wkzB4WxE%2BWH55eCE4j4vKahhf5PHZ7nE0XL15TbbX0XPVUBze8gTSwGymIgLKgYQ5uLkzxTR4s%2FfFba5whFZRIKVdkJhRKfzpdcundLd3tGnvu5Ac1Pqq163aVBp%2Bm1WjRuhQ2%2F3Q08RqnfCPwgoHXketZtfvH%2B3wAAAP%2F%2FAQAA%2F%2F%2F%2F5yLregQAAA%3D%3D IP172.240.108.76:443
CertificateIssuerLet's Encrypt Subjectlodgesweet.com Fingerprint4B:E6:E5:18:A7:CE:25:B5:28:0A:7D:6A:20:3C:0D:DB:99:06:5D:46 ValidityMon, 29 Apr 2024 08:45:06 GMT - Sun, 28 Jul 2024 08:45:05 GMT
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSTWskRRiuXue0XvxYvAgyLAgKMunumemZcZFgjFmCcbMfLn4dpLqrZ1JOdVdT1TU9GS%2FBBdnjHLyol8ozyQY1LPoDXGQSWCQoZi4S0IA%2FwJOweJQeg9EX6v2o5y143vepT7bNKfFh6Mnym3LEhaALzZpbfeEdz7tSXeOpGVaH7eCDoHGlqgYvd4Ka%2B2L1ahz15YLveq7ruV51hau4K4cLJQie7Xe8WsetNfya12xgqP5fa%2BNAUwdscEqeAmezyqFzCTyaIk2%2BWY51P5fZS68nRtBcKgzY3u20n8oiRXKedpWDbrp31g2pj1ceQKa7c7qQg38bQz4jzsMHCNO9M5IIBztznqFAnCJkj6MYTBGLKTidIpJ3wNkxASKGa%2BtIk3vXpCro5j8oLdEZqTz6E7yYkcpvl5Am95cEH1ZvSWFyLlONYdeCD6fgvSkyc4B8dAG8OECUfwzOfiILj9aQJjvrWkhwZuezcz4F704h4jGodmDKwx2YrgOTOUjYSTXyPK%2Flsoi67U4U1VkrDgPmerTV9ajnBm2YqKQ3Rp6NEYkxIrWFTG2hz8dQ5nvoDQvNHOh8RpwbWxgwiyImKDRBQQkKTlDkBMXA7jKhfW3vMaFN6J1F%2FyzW7UTmvW26K%2FNenBJQNYZidjs7JU%2BW%2B3HeO%2FTQj0%2BqXstnnaDt%2Bo1ms1mP227Tp7Qbxl7Iggb16tDcgusL85FHfEbaz%2FyKrNSsbxHSA2hxgIhfBjUeaGFBNyxG6X7O002jRC2RIQeTFlleQb7pbItT8uxcocuVG4ijo8WHF1%2FJJr9cRKQsMmXxIT8k6Im7k5uyIDs3ZaHJt%2BtZzhM%2BoqV6t3Kax4999Ua8WUjFVpf1%2BMtXoxIo0%2F23Yp2v0ZTxtKfJ10ucsVitSBXF5LtV%2FXYcXjd6Y8mo1GRr119bWU0yFWvNZToF5cfrfyHiM1J5%2Fun5t3zixz%2FA1RTKWCTmiJwZuDxAlG1BZ0eL%2Bej3q%2FcvfQQtCZQ47wkzB4WxE%2BWH55eCE4j4vKahhf5PHZ7nE0XL15TbbX0XPVUBze8gTSwGymIgLKgYQ5uLkzxTR4s%2FfFba5whFZRIKVdkJhRKfzpdcundLd3tGnvu5Ac1Pqq163aVBp%2Bm1WjRuhQ2%2F3Q08RqnfCPwgoHXketZtfvH%2B3wAAAP%2F%2FAQAA%2F%2F%2F%2F5yLregQAAA%3D%3D HTTP/1.1
Host: lodgesweet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Cookie: u_pl=22725681; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; nlec172d9680245553e8052aafbe1bd64a13=[2229329,2229337,2229333,2019380]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 4d2d020405bc4eb65f613c1ce37c0217
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| lodgesweet.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRSuXucUL%2F5YvAgyLAgKMunumemZcZHFGCPBuNkfLv46SHVXz6Sc6q6mqmt6klNwQfY4By%2FqpfJNskENon%2BAi0wCiwTFzEUCmn%2FBg7B4lB4HRx90v%2FfqewXf%2B776ZM9cEB%2BGnq%2B%2BJXe4EHS5WXOrL7zreVerGzw1w%2BqwHXwYNK5W1eDlTlBzX6y%2BEUd9uey7nut6rldd4yruyuFyCYJnRx2v1nFrDb%2FmNRsYqv%2F32jjQ1AEbXJCnwNm0cuJcBo8mSJNvV2Pdz2X20uuJETSXCgN2eCftp7JIkSzKrnLQTQ%2Fn05D6bO0BZHowows5%2BHcw5FPiPHyAMD2ck0Q42J%2FxDAXiFCF7HMVgglhMwOkEkbwLzs4IEDFc30Sa3L8uVUG3%2F0FpiU5J5dGf4MWUVH6%2FjDT5ZkXwYfW2FCbnMtUYdi34cALemyAzx8h3LoEXx4jyj8HZz2T50QbSZH9TCwnO7Gx3zifg3QlEPALVDkz5cQem68BkDhJ2Xo08z2u5LKJuuxNFddaKw4C5Hm11Peq5QRsmKumNkGcjRGKESO0iU7vo8xGU%2BQF6y0IzBzqfEufmLgbMoogJCk1QUIKCExQ5QTGwB0xoX9v7TGgTevPsz3PdjmXe26MHMu%2FFKQFVIyhm97IL8mSpj%2FP%2BiYd%2BfF71Wj7rBG3XbzSbzXrcdps%2Bpd0w9kIWNKhXh%2BYWXF%2BarbzDp6T9zG%2FISs%2F6FiE9hhbHiPgVUOOBFhZ0y2InPcp5um2UqCUy5GDSIssryLedPXFBnp05dKXyHuLo9NrDpVey8a9LiJRFpiw%2B4icEPXFvfEsWZP%2BWLDT5bjPLecJ3aOne7Zzm8WNfvRlvF1Kx9VU9%2BvLVqATK8ujtWOcbNGU87Wny9QpnLFZrUkUx%2BX5dvxOHN4zeWjEqNdnGjdfW1pNMxVpzmU5A%2BdnmX4j4lFSef3r2LJ%2F46Q9wNYEyFok5JfMAl8eIsl3obMFeSwIlFjNhdgmFsWPlh4tDwQlEvOhpaKH%2F04eLeqxoeZtyu6fvoacqoPldpInFQFkMhAUVI2izNM4zdXrtx8%2FK%2BByhqIxDoSr7oVDi01LkmzOly9%2BdKXnulwY0P6%2B26nWXBp2m12rRuBU2%2FHY38BilfiPwg4DWketpt%2FnFB38DAAD%2F%2FwEAAP%2F%2FJg6GbXoEAAA%3D | 172.240.108.76 | 200 OK | 7 B |
URL GET HTTP/1.1lodgesweet.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRSuXucUL%2F5YvAgyLAgKMunumemZcZHFGCPBuNkfLv46SHVXz6Sc6q6mqmt6klNwQfY4By%2FqpfJNskENon%2BAi0wCiwTFzEUCmn%2FBg7B4lB4HRx90v%2FfqewXf%2B776ZM9cEB%2BGnq%2B%2BJXe4EHS5WXOrL7zreVerGzw1w%2BqwHXwYNK5W1eDlTlBzX6y%2BEUd9uey7nut6rldd4yruyuFyCYJnRx2v1nFrDb%2FmNRsYqv%2F32jjQ1AEbXJCnwNm0cuJcBo8mSJNvV2Pdz2X20uuJETSXCgN2eCftp7JIkSzKrnLQTQ%2Fn05D6bO0BZHowows5%2BHcw5FPiPHyAMD2ck0Q42J%2FxDAXiFCF7HMVgglhMwOkEkbwLzs4IEDFc30Sa3L8uVUG3%2F0FpiU5J5dGf4MWUVH6%2FjDT5ZkXwYfW2FCbnMtUYdi34cALemyAzx8h3LoEXx4jyj8HZz2T50QbSZH9TCwnO7Gx3zifg3QlEPALVDkz5cQem68BkDhJ2Xo08z2u5LKJuuxNFddaKw4C5Hm11Peq5QRsmKumNkGcjRGKESO0iU7vo8xGU%2BQF6y0IzBzqfEufmLgbMoogJCk1QUIKCExQ5QTGwB0xoX9v7TGgTevPsz3PdjmXe26MHMu%2FFKQFVIyhm97IL8mSpj%2FP%2BiYd%2BfF71Wj7rBG3XbzSbzXrcdps%2Bpd0w9kIWNKhXh%2BYWXF%2BarbzDp6T9zG%2FISs%2F6FiE9hhbHiPgVUOOBFhZ0y2InPcp5um2UqCUy5GDSIssryLedPXFBnp05dKXyHuLo9NrDpVey8a9LiJRFpiw%2B4icEPXFvfEsWZP%2BWLDT5bjPLecJ3aOne7Zzm8WNfvRlvF1Kx9VU9%2BvLVqATK8ujtWOcbNGU87Wny9QpnLFZrUkUx%2BX5dvxOHN4zeWjEqNdnGjdfW1pNMxVpzmU5A%2BdnmX4j4lFSef3r2LJ%2F46Q9wNYEyFok5JfMAl8eIsl3obMFeSwIlFjNhdgmFsWPlh4tDwQlEvOhpaKH%2F04eLeqxoeZtyu6fvoacqoPldpInFQFkMhAUVI2izNM4zdXrtx8%2FK%2BByhqIxDoSr7oVDi01LkmzOly9%2BdKXnulwY0P6%2B26nWXBp2m12rRuBU2%2FHY38BilfiPwg4DWketpt%2FnFB38DAAD%2F%2FwEAAP%2F%2FJg6GbXoEAAA%3D IP172.240.108.76:443
CertificateIssuerLet's Encrypt Subjectlodgesweet.com Fingerprint4B:E6:E5:18:A7:CE:25:B5:28:0A:7D:6A:20:3C:0D:DB:99:06:5D:46 ValidityMon, 29 Apr 2024 08:45:06 GMT - Sun, 28 Jul 2024 08:45:05 GMT
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRSuXucUL%2F5YvAgyLAgKMunumemZcZHFGCPBuNkfLv46SHVXz6Sc6q6mqmt6klNwQfY4By%2FqpfJNskENon%2BAi0wCiwTFzEUCmn%2FBg7B4lB4HRx90v%2FfqewXf%2B776ZM9cEB%2BGnq%2B%2BJXe4EHS5WXOrL7zreVerGzw1w%2BqwHXwYNK5W1eDlTlBzX6y%2BEUd9uey7nut6rldd4yruyuFyCYJnRx2v1nFrDb%2FmNRsYqv%2F32jjQ1AEbXJCnwNm0cuJcBo8mSJNvV2Pdz2X20uuJETSXCgN2eCftp7JIkSzKrnLQTQ%2Fn05D6bO0BZHowows5%2BHcw5FPiPHyAMD2ck0Q42J%2FxDAXiFCF7HMVgglhMwOkEkbwLzs4IEDFc30Sa3L8uVUG3%2F0FpiU5J5dGf4MWUVH6%2FjDT5ZkXwYfW2FCbnMtUYdi34cALemyAzx8h3LoEXx4jyj8HZz2T50QbSZH9TCwnO7Gx3zifg3QlEPALVDkz5cQem68BkDhJ2Xo08z2u5LKJuuxNFddaKw4C5Hm11Peq5QRsmKumNkGcjRGKESO0iU7vo8xGU%2BQF6y0IzBzqfEufmLgbMoogJCk1QUIKCExQ5QTGwB0xoX9v7TGgTevPsz3PdjmXe26MHMu%2FFKQFVIyhm97IL8mSpj%2FP%2BiYd%2BfF71Wj7rBG3XbzSbzXrcdps%2Bpd0w9kIWNKhXh%2BYWXF%2BarbzDp6T9zG%2FISs%2F6FiE9hhbHiPgVUOOBFhZ0y2InPcp5um2UqCUy5GDSIssryLedPXFBnp05dKXyHuLo9NrDpVey8a9LiJRFpiw%2B4icEPXFvfEsWZP%2BWLDT5bjPLecJ3aOne7Zzm8WNfvRlvF1Kx9VU9%2BvLVqATK8ujtWOcbNGU87Wny9QpnLFZrUkUx%2BX5dvxOHN4zeWjEqNdnGjdfW1pNMxVpzmU5A%2BdnmX4j4lFSef3r2LJ%2F46Q9wNYEyFok5JfMAl8eIsl3obMFeSwIlFjNhdgmFsWPlh4tDwQlEvOhpaKH%2F04eLeqxoeZtyu6fvoacqoPldpInFQFkMhAUVI2izNM4zdXrtx8%2FK%2BByhqIxDoSr7oVDi01LkmzOly9%2BdKXnulwY0P6%2B26nWXBp2m12rRuBU2%2FHY38BilfiPwg4DWketpt%2FnFB38DAAD%2F%2FwEAAP%2F%2FJg6GbXoEAAA%3D HTTP/1.1
Host: lodgesweet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Cookie: u_pl=22725681; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; nlec172d9680245553e8052aafbe1bd64a13=[2229329,2229337,2229333,2019380]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 7c94f3aa41e1db29407632c9ce8e114f
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| cdn.cloudimagesb.com/cti/f7/13/0e/f7130e7f47db248dc886c97a1e4c3e2b/1588233482.jpg | 45.133.44.9 | 200 OK | 32 kB |
URL GET HTTP/2cdn.cloudimagesb.com/cti/f7/13/0e/f7130e7f47db248dc886c97a1e4c3e2b/1588233482.jpg IP45.133.44.9:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjectcdn.cloudimagesb.com FingerprintC6:F3:21:F0:21:7D:7E:96:0F:E8:46:7A:5E:C5:3F:D1:52:B0:67:B0 ValidityFri, 22 Mar 2024 03:01:35 GMT - Thu, 20 Jun 2024 03:01:34 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 321x240, components 3 Hash3528385dd0c31dbd2e5bfc4af7a6bec5 832c580ffd7711115d6c036ab4232f5bd88480a4 bfbfeebfcb679ca578055235614cc679b0757bad272996ef89b7fd5615a2db75
GET /cti/f7/13/0e/f7130e7f47db248dc886c97a1e4c3e2b/1588233482.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:11 GMT
content-type: image/jpeg
content-length: 32471
server: nginx/1.21.6
last-modified: Thu, 30 Apr 2020 07:58:05 GMT
etag: "5eaa850d-7ed7"
expires: Mon, 06 May 2024 02:20:11 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| cdn.cloudimagesb.com/cti/5e/78/a9/5e78a94057ff65f06ec19e727c7be04f/1588233511.jpg | 45.133.44.9 | 200 OK | 24 kB |
URL GET HTTP/2cdn.cloudimagesb.com/cti/5e/78/a9/5e78a94057ff65f06ec19e727c7be04f/1588233511.jpg IP45.133.44.9:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjectcdn.cloudimagesb.com FingerprintC6:F3:21:F0:21:7D:7E:96:0F:E8:46:7A:5E:C5:3F:D1:52:B0:67:B0 ValidityFri, 22 Mar 2024 03:01:35 GMT - Thu, 20 Jun 2024 03:01:34 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 320x240, components 3 Hashd71c872fb9f50bd9383abc0721d1d51e 1f69b40ef2f95798b4e0fd738d630ad4319cd739 6b4a622b9de1ffab8fe905fc8c4633994c732476664b5190ceedd62a3795ab08
GET /cti/5e/78/a9/5e78a94057ff65f06ec19e727c7be04f/1588233511.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:11 GMT
content-type: image/jpeg
content-length: 24518
server: nginx/1.21.6
last-modified: Thu, 30 Apr 2020 07:58:34 GMT
etag: "5eaa852a-5fc6"
expires: Mon, 06 May 2024 02:20:11 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| traditionallyrecipepiteous.com/watch.650614696272.js?dev=e&key=fb87135eb1bdee211d55a6d31f28b1bc&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&pst=1714789271&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&res=14.2071&rmtc=t&shu=55b499db356b9d4e6ee64d7eb80d0df99fb35774d265a7ebb9d3be33ad6b80f18bc039e677e026ab6c432861b5ceac161f0e6a66be04a164e8e53d5baa9e3f88d787ed203d11d19bbe596cefe8b090c27d2da97dfd86972699c3f818952c&tz=0&uuid=618d663e-f8d5-4c45-a0b2-22a33ee384d6%3A1%3A1 | 172.240.108.76 | 200 OK | 2.1 kB |
URL GET HTTP/1.1traditionallyrecipepiteous.com/watch.650614696272.js?dev=e&key=fb87135eb1bdee211d55a6d31f28b1bc&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&pst=1714789271&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&res=14.2071&rmtc=t&shu=55b499db356b9d4e6ee64d7eb80d0df99fb35774d265a7ebb9d3be33ad6b80f18bc039e677e026ab6c432861b5ceac161f0e6a66be04a164e8e53d5baa9e3f88d787ed203d11d19bbe596cefe8b090c27d2da97dfd86972699c3f818952c&tz=0&uuid=618d663e-f8d5-4c45-a0b2-22a33ee384d6%3A1%3A1 IP172.240.108.76:443
CertificateIssuerLet's Encrypt Subjecttraditionallyrecipepiteous.com FingerprintC5:96:CF:B1:E4:A5:34:EC:37:89:CA:97:7E:35:7C:5C:00:54:6D:92 ValidityMon, 29 Apr 2024 13:00:48 GMT - Sun, 28 Jul 2024 13:00:47 GMT
File typeJavaScript source, ASCII text, with very long lines (2669) Hash1af11c346e79ebf72b885fbb777580c6 0feb4927e3a948813f04843f37868e63e6e156b1 7da3c2c6f4ee0f5c69cb0fec4cd67058ea9b48df08dc557746e6960d79e9e605
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /watch.650614696272.js?dev=e&key=fb87135eb1bdee211d55a6d31f28b1bc&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&pst=1714789271&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&res=14.2071&rmtc=t&shu=55b499db356b9d4e6ee64d7eb80d0df99fb35774d265a7ebb9d3be33ad6b80f18bc039e677e026ab6c432861b5ceac161f0e6a66be04a164e8e53d5baa9e3f88d787ed203d11d19bbe596cefe8b090c27d2da97dfd86972699c3f818952c&tz=0&uuid=618d663e-f8d5-4c45-a0b2-22a33ee384d6%3A1%3A1 HTTP/1.1
Host: traditionallyrecipepiteous.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zip.lu
Referer: https://zip.lu/
DNT: 1
Connection: keep-alive
Cookie: u_pl=22829219; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMjgyOTIxOSwiayI6ImZiODcxMzVlYjFiZGVlMjExZDU1YTZkMzFmMjhiMWJjIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjozNjc1ODY4LCJwaWQiOjkzMDg4LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjM0LCJhaWQiOjMyLCJwdCI6NCwicGsiOiJ6YXM3dzFtanQiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6Nzk5NTQxOTYsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjoxODExMCwib24iOiJMaW51eCIsIm92IjoiVW5rbm93biIsImJpZCI6MTE2NjcwLCJibiI6IkZpcmVmb3giLCJidiI6Ijk2LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly96aXAubHUvP2Jhbm5lZD0xIiwiYXIiOltdfX0.x4V-YbMaz28DxGpGZqZohRewgpsltxYPfC_5fIrdH0Y
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zip.lu
Access-Control-Allow-Origin: https://zip.lu
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=618d663e-f8d5-4c45-a0b2-22a33ee384d6:1:1; expires=Sat, 11 May 2024 02:20:11 GMT; secure; SameSite=None
iprcf9b75833caf19f89fdd5b518509707f9=3570421; expires=Sat, 04 May 2024 06:20:11 GMT; secure; SameSite=None
pdhtkv=true; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
uncs=1; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
pdhtkv32=true; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
uncs32=1; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 5050b188f30d5892a39b4bfcffdce3a4
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| cdn.cloudimagesb.com/cti/d6/e8/37/d6e83777d7311d26f1ac5b2b62a81218/1588233535.jpg | 45.133.44.9 | 200 OK | 28 kB |
URL GET HTTP/2cdn.cloudimagesb.com/cti/d6/e8/37/d6e83777d7311d26f1ac5b2b62a81218/1588233535.jpg IP45.133.44.9:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjectcdn.cloudimagesb.com FingerprintC6:F3:21:F0:21:7D:7E:96:0F:E8:46:7A:5E:C5:3F:D1:52:B0:67:B0 ValidityFri, 22 Mar 2024 03:01:35 GMT - Thu, 20 Jun 2024 03:01:34 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 320x240, components 3 Hash1dcde64d47d24d151a1433ecf4403dd7 443d6704b5a294e000084d7a8ac823e526093928 d11bcd65a82589c2c31d6fd87cb16ec673dd5640462ad3d20ff53e014a435376
GET /cti/d6/e8/37/d6e83777d7311d26f1ac5b2b62a81218/1588233535.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:11 GMT
content-type: image/jpeg
content-length: 27832
server: nginx/1.21.6
last-modified: Thu, 30 Apr 2020 07:58:58 GMT
etag: "5eaa8542-6cb8"
expires: Mon, 06 May 2024 02:20:11 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| enraptureshut.com/watch.1358517985717.js?dev=e&key=6dc3a27552b5aedfb96aeaa00aa1c37b&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&pst=1714789271&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&res=14.2071&rmtc=t&shu=5977dab582a9bed8b81a67b21859682164cbc95a71579d4578cd2d91c200879dd9ff8c5b2196274c36e3cf71fd79264b8d100f913aee4011f973e60739cd5126eb3665e28fda85a1da32741835d2549286d3f05b8234aaac22a41482bb794e&tz=0&uuid=fbbf0c59-587c-4857-b0d9-a1ebcf1b13b6%3A3%3A1 | 192.243.59.12 | 200 OK | 2.1 kB |
URL GET HTTP/1.1enraptureshut.com/watch.1358517985717.js?dev=e&key=6dc3a27552b5aedfb96aeaa00aa1c37b&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&pst=1714789271&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&res=14.2071&rmtc=t&shu=5977dab582a9bed8b81a67b21859682164cbc95a71579d4578cd2d91c200879dd9ff8c5b2196274c36e3cf71fd79264b8d100f913aee4011f973e60739cd5126eb3665e28fda85a1da32741835d2549286d3f05b8234aaac22a41482bb794e&tz=0&uuid=fbbf0c59-587c-4857-b0d9-a1ebcf1b13b6%3A3%3A1 IP192.243.59.12:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjectenraptureshut.com Fingerprint1D:09:0B:4D:F8:08:58:15:8B:41:5A:C9:BA:21:61:3A:BF:2F:54:96 ValidityMon, 29 Apr 2024 08:19:25 GMT - Sun, 28 Jul 2024 08:19:24 GMT
File typeJavaScript source, ASCII text, with very long lines (2639) Hash36752316ef6864c819b0078e59024f22 1242def2a8449cc272f63570c60640a382e9bbdc b8e9cd938867ea640957f3c939f122895624acc1e5a656cf14afbc4f198f6233
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /watch.1358517985717.js?dev=e&key=6dc3a27552b5aedfb96aeaa00aa1c37b&kw=%5B%22zip%22%2C%22url%22%2C%22shortener%22%5D&pst=1714789271&refer=https%3A%2F%2Fzip.lu%2F%3Fbanned%3D1&res=14.2071&rmtc=t&shu=5977dab582a9bed8b81a67b21859682164cbc95a71579d4578cd2d91c200879dd9ff8c5b2196274c36e3cf71fd79264b8d100f913aee4011f973e60739cd5126eb3665e28fda85a1da32741835d2549286d3f05b8234aaac22a41482bb794e&tz=0&uuid=fbbf0c59-587c-4857-b0d9-a1ebcf1b13b6%3A3%3A1 HTTP/1.1
Host: enraptureshut.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://zip.lu
Referer: https://zip.lu/
DNT: 1
Connection: keep-alive
Cookie: u_pl=22735548; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMjczNTU0OCwiayI6IjZkYzNhMjc1NTJiNWFlZGZiOTZhZWFhMDBhYTFjMzdiIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjozNjc1ODY4LCJwaWQiOjkzMDg4LCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjM0LCJhaWQiOjUsInB0Ijo0LCJwayI6Inc3cTYxZHZqbWUiLCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6Nzk5NTQxOTYsImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjoxODExMCwib24iOiJMaW51eCIsIm92IjoiVW5rbm93biIsImJpZCI6MTE2NjcwLCJibiI6IkZpcmVmb3giLCJidiI6Ijk2LjAiLCJ3diI6ZmFsc2UsImUiOnRydWUsImFiIjpmYWxzZX0sImMiOnsiaWQiOjE2MiwiYyI6Ik5PIiwibiI6Ik5vcndheSJ9LCJhIjpmYWxzZSwiY3IiOnsibiI6IkJsaXggU29sdXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiaHR0cHM6Ly96aXAubHUvP2Jhbm5lZD0xIiwiYXIiOltdfX0.Wlik0i7U6TMsAzL1Ct4uONsIP4EB7gWVCej1azy-STE
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://zip.lu
Access-Control-Allow-Origin: https://zip.lu
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=fbbf0c59-587c-4857-b0d9-a1ebcf1b13b6:3:1; expires=Sat, 11 May 2024 02:20:11 GMT; secure; SameSite=None
iprc4b56fed1e728b302470915317a1ce87e=3569806; expires=Sat, 04 May 2024 06:20:11 GMT; secure; SameSite=None
pdhtkv=true; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
uncs=1; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
pdhtkv5=true; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
uncs5=1; expires=Sun, 05 May 2024 02:20:11 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 9e7f7644847909c1c50c3a588ac755b6
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| cdn.cloudimagesb.com/cti/d7/14/ea/d714ea0356c58a2679ce4074962c0e16/1588233398.jpeg | 45.133.44.9 | 200 OK | 23 kB |
URL GET HTTP/2cdn.cloudimagesb.com/cti/d7/14/ea/d714ea0356c58a2679ce4074962c0e16/1588233398.jpeg IP45.133.44.9:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjectcdn.cloudimagesb.com FingerprintC6:F3:21:F0:21:7D:7E:96:0F:E8:46:7A:5E:C5:3F:D1:52:B0:67:B0 ValidityFri, 22 Mar 2024 03:01:35 GMT - Thu, 20 Jun 2024 03:01:34 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 320x240, components 3 Hash9a2dc4fe2ebb70df2dfb1566d22970b8 b85a5f4ef7bd68b834d03d8b9a552e2e546e8701 1983c705f5f4315c8cd002183eb9ed3c846abed8fc2a6f0a073185c249552efd
GET /cti/d7/14/ea/d714ea0356c58a2679ce4074962c0e16/1588233398.jpeg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:11 GMT
content-type: image/jpeg
content-length: 22757
server: nginx/1.21.6
last-modified: Thu, 30 Apr 2020 07:56:41 GMT
etag: "5eaa84b9-58e5"
expires: Mon, 06 May 2024 02:20:11 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| lodgesweet.com/ren.gif?sid=H4sIAAAAAAAC%2F1RST2skxRuu3p1TfpefungRZFgQFGTS3TPTM%2BMiizFGgnGzf1z8d5Dqrp5JOdVdTVXX9CSn4ILscQ5e1EvlmWSDGkQ%2FgItMAosExcxFApqP4EVYPEqPg6MvdL%2FvW89b8LzPUx%2FvmQviw9Dz1TflDheCLjdrbvX5dzzvWnWDp2ZYHbaDD4LGtaoavNQJau4L1dfjqC%2BXfddzXc%2F1qmtcxV05XC5B8Oyo49U6bq3h17xmA0P1314bB5o6YIML8iQ4m1ZOnCvg0QRp8s1qrPu5zF58LTGC5lJhwA7vpv1UFimSRdlVDrrp4XwaUp%2BtPYRMD2Z0IQf%2FDIZ8SpxHDxGmh3OSCAf7M56hQJwiZP9DMZggFhNwOkEk74GzMwJEDDc2kSYPbkhV0O2%2FUVqiU1J5%2FAd4MSWV364gTb5eEXxYvSOFyblMNYZdCz6cgPcmyMwx8p1L4MUxovwjcPYTWX68gTTZ39RCgjM7253zCXh3AhGPQLUDU37cgek6MJmDhJ1XI8%2FzWi6LqNvuRFGdteIwYK5HW12Pem7QholKeiPk2QiRGCFSu8jULvp8BGW%2Bh96y0MyBzqfEubWLAbMoYoJCExSUoOAERU5QDOwBE9rX9gET2oTePPvzXLdjmff26IHMe3FKQNUIitm97II8UerjvHfioR%2BfV72WzzpB2%2FUbzWazHrfdpk9pN4y9kAUN6tWhuQXXl2Yr7%2FApaT%2F9K7LSs75FSI%2BhxTEifhXUeKCFBd2y2EmPcp5uGyVqiQw5mLTI8grybWdPXJBnZg5drdxFHJ1ef7T0cjb%2BZQmRssiUxYf8hKAn7o9vy4Ls35aFJt9uZjlP%2BA4t3buT0zy%2B%2FOUb8XYhFVtf1aMvXolKoCyP3op1vkFTxtOeJl%2BtcMZitSZVFJPv1vXbcXjT6K0Vo1KTbdx8dW09yVSsNZfpBJSfbf6JiE9J5bmnZs%2Fy%2Fz%2F%2BDq4mUMYiMadkHuDyGFG2C50t2GtJoMRiJswuozB2rPxwcSg4gYgXPQ0t9L%2F6cFGPFS1vU2739H30VAU0v4c0sRgoi4GwoGIEbZbGeaZOr%2F%2FwaRmfIRSVcShUZT8USnxSinyr%2FL07k3tKnv25Ac3Pq6163aVBp%2Bm1WjRuhQ2%2F3Q08RqnfCPwgoHXketptfv7%2BXwAAAP%2F%2FAQAA%2F%2F%2BaAoVaegQAAA%3D%3D | 172.240.108.76 | 200 OK | 7 B |
URL GET HTTP/1.1lodgesweet.com/ren.gif?sid=H4sIAAAAAAAC%2F1RST2skxRuu3p1TfpefungRZFgQFGTS3TPTM%2BMiizFGgnGzf1z8d5Dqrp5JOdVdTVXX9CSn4ILscQ5e1EvlmWSDGkQ%2FgItMAosExcxFApqP4EVYPEqPg6MvdL%2FvW89b8LzPUx%2FvmQviw9Dz1TflDheCLjdrbvX5dzzvWnWDp2ZYHbaDD4LGtaoavNQJau4L1dfjqC%2BXfddzXc%2F1qmtcxV05XC5B8Oyo49U6bq3h17xmA0P1314bB5o6YIML8iQ4m1ZOnCvg0QRp8s1qrPu5zF58LTGC5lJhwA7vpv1UFimSRdlVDrrp4XwaUp%2BtPYRMD2Z0IQf%2FDIZ8SpxHDxGmh3OSCAf7M56hQJwiZP9DMZggFhNwOkEk74GzMwJEDDc2kSYPbkhV0O2%2FUVqiU1J5%2FAd4MSWV364gTb5eEXxYvSOFyblMNYZdCz6cgPcmyMwx8p1L4MUxovwjcPYTWX68gTTZ39RCgjM7253zCXh3AhGPQLUDU37cgek6MJmDhJ1XI8%2FzWi6LqNvuRFGdteIwYK5HW12Pem7QholKeiPk2QiRGCFSu8jULvp8BGW%2Bh96y0MyBzqfEubWLAbMoYoJCExSUoOAERU5QDOwBE9rX9gET2oTePPvzXLdjmff26IHMe3FKQNUIitm97II8UerjvHfioR%2BfV72WzzpB2%2FUbzWazHrfdpk9pN4y9kAUN6tWhuQXXl2Yr7%2FApaT%2F9K7LSs75FSI%2BhxTEifhXUeKCFBd2y2EmPcp5uGyVqiQw5mLTI8grybWdPXJBnZg5drdxFHJ1ef7T0cjb%2BZQmRssiUxYf8hKAn7o9vy4Ls35aFJt9uZjlP%2BA4t3buT0zy%2B%2FOUb8XYhFVtf1aMvXolKoCyP3op1vkFTxtOeJl%2BtcMZitSZVFJPv1vXbcXjT6K0Vo1KTbdx8dW09yVSsNZfpBJSfbf6JiE9J5bmnZs%2Fy%2Fz%2F%2BDq4mUMYiMadkHuDyGFG2C50t2GtJoMRiJswuozB2rPxwcSg4gYgXPQ0t9L%2F6cFGPFS1vU2739H30VAU0v4c0sRgoi4GwoGIEbZbGeaZOr%2F%2FwaRmfIRSVcShUZT8USnxSinyr%2FL07k3tKnv25Ac3Pq6163aVBp%2Bm1WjRuhQ2%2F3Q08RqnfCPwgoHXketptfv7%2BXwAAAP%2F%2FAQAA%2F%2F%2BaAoVaegQAAA%3D%3D IP172.240.108.76:443
CertificateIssuerLet's Encrypt Subjectlodgesweet.com Fingerprint4B:E6:E5:18:A7:CE:25:B5:28:0A:7D:6A:20:3C:0D:DB:99:06:5D:46 ValidityMon, 29 Apr 2024 08:45:06 GMT - Sun, 28 Jul 2024 08:45:05 GMT
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RST2skxRuu3p1TfpefungRZFgQFGTS3TPTM%2BMiizFGgnGzf1z8d5Dqrp5JOdVdTVXX9CSn4ILscQ5e1EvlmWSDGkQ%2FgItMAosExcxFApqP4EVYPEqPg6MvdL%2FvW89b8LzPUx%2FvmQviw9Dz1TflDheCLjdrbvX5dzzvWnWDp2ZYHbaDD4LGtaoavNQJau4L1dfjqC%2BXfddzXc%2F1qmtcxV05XC5B8Oyo49U6bq3h17xmA0P1314bB5o6YIML8iQ4m1ZOnCvg0QRp8s1qrPu5zF58LTGC5lJhwA7vpv1UFimSRdlVDrrp4XwaUp%2BtPYRMD2Z0IQf%2FDIZ8SpxHDxGmh3OSCAf7M56hQJwiZP9DMZggFhNwOkEk74GzMwJEDDc2kSYPbkhV0O2%2FUVqiU1J5%2FAd4MSWV364gTb5eEXxYvSOFyblMNYZdCz6cgPcmyMwx8p1L4MUxovwjcPYTWX68gTTZ39RCgjM7253zCXh3AhGPQLUDU37cgek6MJmDhJ1XI8%2FzWi6LqNvuRFGdteIwYK5HW12Pem7QholKeiPk2QiRGCFSu8jULvp8BGW%2Bh96y0MyBzqfEubWLAbMoYoJCExSUoOAERU5QDOwBE9rX9gET2oTePPvzXLdjmff26IHMe3FKQNUIitm97II8UerjvHfioR%2BfV72WzzpB2%2FUbzWazHrfdpk9pN4y9kAUN6tWhuQXXl2Yr7%2FApaT%2F9K7LSs75FSI%2BhxTEifhXUeKCFBd2y2EmPcp5uGyVqiQw5mLTI8grybWdPXJBnZg5drdxFHJ1ef7T0cjb%2BZQmRssiUxYf8hKAn7o9vy4Ls35aFJt9uZjlP%2BA4t3buT0zy%2B%2FOUb8XYhFVtf1aMvXolKoCyP3op1vkFTxtOeJl%2BtcMZitSZVFJPv1vXbcXjT6K0Vo1KTbdx8dW09yVSsNZfpBJSfbf6JiE9J5bmnZs%2Fy%2Fz%2F%2BDq4mUMYiMadkHuDyGFG2C50t2GtJoMRiJswuozB2rPxwcSg4gYgXPQ0t9L%2F6cFGPFS1vU2739H30VAU0v4c0sRgoi4GwoGIEbZbGeaZOr%2F%2FwaRmfIRSVcShUZT8USnxSinyr%2FL07k3tKnv25Ac3Pq6163aVBp%2Bm1WjRuhQ2%2F3Q08RqnfCPwgoHXketptfv7%2BXwAAAP%2F%2FAQAA%2F%2F%2BaAoVaegQAAA%3D%3D HTTP/1.1
Host: lodgesweet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Cookie: u_pl=22725681; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; nlec172d9680245553e8052aafbe1bd64a13=[2229329,2229337,2229333,2019380]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 97fc536ef1f9e552cb06e60cbab2eded
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| lodgesweet.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRSuXucUQVAXL4IMC4KKTLp7ZnpmXGQxxkgwbvaHi78OUt3VMymnuqup6pqe5BRckD3OwYt6qXyTbFCD6B%2FgIpPAIgExc5GA5p8QFo%2FSs4OjD%2Br9qO8VfO999fmeuSA%2BDD1ffVfucCHocrPmVl%2F6wPOuVjd4aobVYTv4JGhcrarBa52g5r5cfTuO%2BnLZdz3X9VyvusZV3JXD5RIEz446Xq3j1hp%2BzWs2MFT%2Fr7VxoKkDNrggz4CzaeXEuQweTZAmP6zGup%2FL7NW3EiNoLhUG7PBO2k9lkSJZpF3loJsezrsh9dnaA8j0YEYXcvBvY8inxHn4AGF6OCeJcLA%2F4xkKxClC9iSKwQSxmIDTCSJ5F5ydESBiuL6JNLl%2FXaqCbj9GaYlOSeXRX%2BDFlFT%2BvIw0%2BX5F8GH1thQm5zLVGHYt%2BHAC3psgM8fIdy6BF8eI8s%2FA2a9k%2BdEG0mR%2FUwsJzuxsds4n4N0JRDwC1Q5MebgD03VgMgcJO69Gnue1XBZRt92JojprxWHAXI%2B2uh713KANE5X0RsizESIxQqR2kald9PkIyvwMvWWhmQOdT4lzcxcDZlHEBIUmKChBwQmKnKAY2AMmtK%2FtfSa0Cb159Oexbscy7%2B3RA5n34pSAqhEUs3vZBXm63I%2Fz0YmHfnxe9Vo%2B6wRt1280m8163HabPqXdMPZCFjSoV4fmFlxfmo28w6ek%2FdwfyErN%2BhYhPYYWx4j4FVDjgRYWdMtiJz3KebptlKglMuRg0iLLK8i3nT1xQZ6fKfTCbw3E0em1h0uvZ%2BPflxApi0xZfMpPCHri3viWLMj%2BLVlo8uNmlvOE79BSvds5zeMnvn0n3i6kYuurevTNG1EJlOnRe7HON2jKeNrT5LsVzlis1qSKYvLTun4%2FDm8YvbViVGqyjRtvrq0nmYq15jKdgPKzzb8R8SmpvPjs7Fs%2BdfYKuJpAGYvEnJK5gctjRNkudLZgryWBEoueMKugMHas%2FHBxKTiBiBc1DS30f%2BpwkY8VLV9Tbvf0PfRUBTS%2FizSxGCiLgbCgYgRtlsZ5pk6v%2FfJlaV8hFJVxKFRlPxRKfDElVyo3S%2Fdh6e483rnm59VWve7SoNP0Wi0at8KG3%2B4GHqPUbwR%2BENA6cj3tNr%2F%2B%2BB8AAAD%2F%2FwEAAP%2F%2F0XbxHnoEAAA%3D | 172.240.108.76 | 200 OK | 7 B |
URL GET HTTP/1.1lodgesweet.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRSuXucUQVAXL4IMC4KKTLp7ZnpmXGQxxkgwbvaHi78OUt3VMymnuqup6pqe5BRckD3OwYt6qXyTbFCD6B%2FgIpPAIgExc5GA5p8QFo%2FSs4OjD%2Br9qO8VfO999fmeuSA%2BDD1ffVfucCHocrPmVl%2F6wPOuVjd4aobVYTv4JGhcrarBa52g5r5cfTuO%2BnLZdz3X9VyvusZV3JXD5RIEz446Xq3j1hp%2BzWs2MFT%2Fr7VxoKkDNrggz4CzaeXEuQweTZAmP6zGup%2FL7NW3EiNoLhUG7PBO2k9lkSJZpF3loJsezrsh9dnaA8j0YEYXcvBvY8inxHn4AGF6OCeJcLA%2F4xkKxClC9iSKwQSxmIDTCSJ5F5ydESBiuL6JNLl%2FXaqCbj9GaYlOSeXRX%2BDFlFT%2BvIw0%2BX5F8GH1thQm5zLVGHYt%2BHAC3psgM8fIdy6BF8eI8s%2FA2a9k%2BdEG0mR%2FUwsJzuxsds4n4N0JRDwC1Q5MebgD03VgMgcJO69Gnue1XBZRt92JojprxWHAXI%2B2uh713KANE5X0RsizESIxQqR2kald9PkIyvwMvWWhmQOdT4lzcxcDZlHEBIUmKChBwQmKnKAY2AMmtK%2FtfSa0Cb159Oexbscy7%2B3RA5n34pSAqhEUs3vZBXm63I%2Fz0YmHfnxe9Vo%2B6wRt1280m8163HabPqXdMPZCFjSoV4fmFlxfmo28w6ek%2FdwfyErN%2BhYhPYYWx4j4FVDjgRYWdMtiJz3KebptlKglMuRg0iLLK8i3nT1xQZ6fKfTCbw3E0em1h0uvZ%2BPflxApi0xZfMpPCHri3viWLMj%2BLVlo8uNmlvOE79BSvds5zeMnvn0n3i6kYuurevTNG1EJlOnRe7HON2jKeNrT5LsVzlis1qSKYvLTun4%2FDm8YvbViVGqyjRtvrq0nmYq15jKdgPKzzb8R8SmpvPjs7Fs%2BdfYKuJpAGYvEnJK5gctjRNkudLZgryWBEoueMKugMHas%2FHBxKTiBiBc1DS30f%2BpwkY8VLV9Tbvf0PfRUBTS%2FizSxGCiLgbCgYgRtlsZ5pk6v%2FfJlaV8hFJVxKFRlPxRKfDElVyo3S%2Fdh6e483rnm59VWve7SoNP0Wi0at8KG3%2B4GHqPUbwR%2BENA6cj3tNr%2F%2B%2BB8AAAD%2F%2FwEAAP%2F%2F0XbxHnoEAAA%3D IP172.240.108.76:443
CertificateIssuerLet's Encrypt Subjectlodgesweet.com Fingerprint4B:E6:E5:18:A7:CE:25:B5:28:0A:7D:6A:20:3C:0D:DB:99:06:5D:46 ValidityMon, 29 Apr 2024 08:45:06 GMT - Sun, 28 Jul 2024 08:45:05 GMT
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRSuXucUQVAXL4IMC4KKTLp7ZnpmXGQxxkgwbvaHi78OUt3VMymnuqup6pqe5BRckD3OwYt6qXyTbFCD6B%2FgIpPAIgExc5GA5p8QFo%2FSs4OjD%2Br9qO8VfO999fmeuSA%2BDD1ffVfucCHocrPmVl%2F6wPOuVjd4aobVYTv4JGhcrarBa52g5r5cfTuO%2BnLZdz3X9VyvusZV3JXD5RIEz446Xq3j1hp%2BzWs2MFT%2Fr7VxoKkDNrggz4CzaeXEuQweTZAmP6zGup%2FL7NW3EiNoLhUG7PBO2k9lkSJZpF3loJsezrsh9dnaA8j0YEYXcvBvY8inxHn4AGF6OCeJcLA%2F4xkKxClC9iSKwQSxmIDTCSJ5F5ydESBiuL6JNLl%2FXaqCbj9GaYlOSeXRX%2BDFlFT%2BvIw0%2BX5F8GH1thQm5zLVGHYt%2BHAC3psgM8fIdy6BF8eI8s%2FA2a9k%2BdEG0mR%2FUwsJzuxsds4n4N0JRDwC1Q5MebgD03VgMgcJO69Gnue1XBZRt92JojprxWHAXI%2B2uh713KANE5X0RsizESIxQqR2kald9PkIyvwMvWWhmQOdT4lzcxcDZlHEBIUmKChBwQmKnKAY2AMmtK%2FtfSa0Cb159Oexbscy7%2B3RA5n34pSAqhEUs3vZBXm63I%2Fz0YmHfnxe9Vo%2B6wRt1280m8163HabPqXdMPZCFjSoV4fmFlxfmo28w6ek%2FdwfyErN%2BhYhPYYWx4j4FVDjgRYWdMtiJz3KebptlKglMuRg0iLLK8i3nT1xQZ6fKfTCbw3E0em1h0uvZ%2BPflxApi0xZfMpPCHri3viWLMj%2BLVlo8uNmlvOE79BSvds5zeMnvn0n3i6kYuurevTNG1EJlOnRe7HON2jKeNrT5LsVzlis1qSKYvLTun4%2FDm8YvbViVGqyjRtvrq0nmYq15jKdgPKzzb8R8SmpvPjs7Fs%2BdfYKuJpAGYvEnJK5gctjRNkudLZgryWBEoueMKugMHas%2FHBxKTiBiBc1DS30f%2BpwkY8VLV9Tbvf0PfRUBTS%2FizSxGCiLgbCgYgRtlsZ5pk6v%2FfJlaV8hFJVxKFRlPxRKfDElVyo3S%2Fdh6e483rnm59VWve7SoNP0Wi0at8KG3%2B4GHqPUbwR%2BENA6cj3tNr%2F%2B%2BB8AAAD%2F%2FwEAAP%2F%2F0XbxHnoEAAA%3D HTTP/1.1
Host: lodgesweet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Cookie: u_pl=22725681; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; nlec172d9680245553e8052aafbe1bd64a13=[2229329,2229337,2229333,2019380]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: efddad09dfe62774e499108b278a9921
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| consistedlovedstimulate.com/pixel/purst?dl=0&th=0&sc=0&rs=2513&rd=2513&fd=765&bv=24.5.6485&tmpl=136 | 192.243.59.20 | 200 OK | 0 B |
URL GET HTTP/1.1consistedlovedstimulate.com/pixel/purst?dl=0&th=0&sc=0&rs=2513&rd=2513&fd=765&bv=24.5.6485&tmpl=136 IP192.243.59.20:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjectconsistedlovedstimulate.com FingerprintF2:89:DF:50:4E:64:82:FC:23:C5:9F:72:0C:73:A2:EA:95:D5:47:E9 ValidityMon, 29 Apr 2024 12:51:51 GMT - Sun, 28 Jul 2024 12:51:50 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/purst?dl=0&th=0&sc=0&rs=2513&rd=2513&fd=765&bv=24.5.6485&tmpl=136 HTTP/1.1
Host: consistedlovedstimulate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| cdn.cloudimagesb.com/cti/43/ff/51/43ff51c07da75eaedd548042d5154cfe/1658930770.jpg | 45.133.44.9 | 200 OK | 25 kB |
URL GET HTTP/2cdn.cloudimagesb.com/cti/43/ff/51/43ff51c07da75eaedd548042d5154cfe/1658930770.jpg IP45.133.44.9:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjectcdn.cloudimagesb.com FingerprintC6:F3:21:F0:21:7D:7E:96:0F:E8:46:7A:5E:C5:3F:D1:52:B0:67:B0 ValidityFri, 22 Mar 2024 03:01:35 GMT - Thu, 20 Jun 2024 03:01:34 GMT
File typeJPEG image data, baseline, precision 8, 320x50, components 3 Hashd465d02b90e928dfd9d9846e102a9dac 22f7333777bec813bd9a7b870913a2b79b6d2fe4 e393d4f1c6b5d4973e157f0f10764b92037dc18239500f42b72bed8ecef462fd
GET /cti/43/ff/51/43ff51c07da75eaedd548042d5154cfe/1658930770.jpg HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:11 GMT
content-type: image/jpeg
content-length: 24714
server: nginx/1.21.6
last-modified: Wed, 27 Jul 2022 14:06:18 GMT
etag: "62e1465a-608a"
expires: Mon, 06 May 2024 02:20:11 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| cdn.cloudimagesb.com/cti/7d/00/a0/7d00a008556ebc4e68d1de531274e928/1658920033.png | 45.133.44.9 | 200 OK | 144 kB |
URL GET HTTP/2cdn.cloudimagesb.com/cti/7d/00/a0/7d00a008556ebc4e68d1de531274e928/1658920033.png IP45.133.44.9:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjectcdn.cloudimagesb.com FingerprintC6:F3:21:F0:21:7D:7E:96:0F:E8:46:7A:5E:C5:3F:D1:52:B0:67:B0 ValidityFri, 22 Mar 2024 03:01:35 GMT - Thu, 20 Jun 2024 03:01:34 GMT
File typePNG image data, 300 x 250, 8-bit/color RGBA, non-interlaced Size144 kB (144379 bytes) Hash33c304429dc1a4408a96e6a74ffa2feb c45fa8e65528d1bb2b46bf8a28af9eeaa1903d04 dbed482e5948ead5587d30a22306a5b611305f704de940bd22c76daf90e0a314
GET /cti/7d/00/a0/7d00a008556ebc4e68d1de531274e928/1658920033.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:11 GMT
content-type: image/png
content-length: 144379
server: nginx/1.21.6
last-modified: Wed, 27 Jul 2022 11:07:21 GMT
etag: "62e11c69-233fb"
expires: Mon, 06 May 2024 02:20:11 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| lodgesweet.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSy2skRRivXue0XnwsXgQZFgQFmXTPOy6yuMYswbjZh4uvg9SrJ%2BVUdzVV3dOT8RJckD3OwYt66fwm2aCGRf8AF5kEFgmKmYsENOAf4ElYPEqPwegH9T3q9xX8vu9Xn2xlJ6SOjB4vvWlGSmu60Kr51RfeCYJL1VUVZ8PqsNv%2BoN28VLWDlxfbNf%2FF6lXJ%2B2ah7ge%2BH%2FhBdVlZGZrhQglCJXuLQW3RrzXrtaDVxND%2Bv3aZB0c9iMEJeQpKzCoH3gUoPkUcfbMkXT81yUuvR5mmqbEYiN3bcT82eYzoLA2thzDePe2GcUfLD2DinTldmMG%2FjUzNiPfwAVi8e0oSbLA958k0ZAwmHkc%2BmELqKRSdgps7UOKIAFzg2hri6N41Y3O68Q9KS3RGKo%2F%2BhMpnpPLbBcTR%2FStaDau3jM5SZWKHYVhADadQvSmSbB%2Fp6BxUvg%2BefgwlfiILj1YRR9trThsoUcxnV2oKFU6h5RjUecjKozxkoYcs8RCJ4yoPgqDjC0797iLnDdGRrC38gHbCgAZ%2Bu4uMl%2FTGSJMxuB6D200kdhN9NYbNvodbL%2BCEB5fOiHdjEwNRIJcEuSPIKUGuCPKUIB8UO0K7uivuCe0yFpzG%2BmlsFBOT9rbojkl7Miagdgwriq3khDxZ7sd77yBAXx5Xg05dLLa7fr3ZarUasuu36pSGTAZMtJs0aMCpAsqdm488UjPSfeZXJKVm%2FQKM7sPpfXB1ETQLQPMCdL3AKN5LVbyRWV2LDFMQpkCSVpBueFv6hDw7V%2Bhi5QYkP7z88PwryeSX8%2BC2QGILfKgOCHr67uSmycn2TZM78u1akqpIjWip3q2UpvKxr96QG7mxYmXJjb98lZdAme69JV26SmOh4p4jX19RQki7bCyX5LsV97Zk1zO3fiWzcZasXn9teSVKrHROmXgKqo7W%2FgJXM1J5%2Fun5t3zixz%2Bg7BQ2KxBlh%2BTUoMw%2BeLIJlxxeTke%2FX71%2F4SM4Q2D1WQ9LPORZMbF1dnapFYGWZzVlBdx%2FanaWTywtX1NVbLm76NkKaHoHcVRgYAsMdAGqx3DZ%2BUma2MPLP3xW2udgujJh2la2mbb60%2FmSS%2Fdu6W7PyHM%2FN%2BHUcbXhiw6Toeww2Ww1Q8kFa7WYz0POGqLb5UjdLGx98f7fAAAA%2F%2F8BAAD%2F%2F38z9wN6BAAA | 192.243.59.13 | 200 OK | 7 B |
URL GET HTTP/1.1lodgesweet.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSy2skRRivXue0XnwsXgQZFgQFmXTPOy6yuMYswbjZh4uvg9SrJ%2BVUdzVV3dOT8RJckD3OwYt66fwm2aCGRf8AF5kEFgmKmYsENOAf4ElYPEqPwegH9T3q9xX8vu9Xn2xlJ6SOjB4vvWlGSmu60Kr51RfeCYJL1VUVZ8PqsNv%2BoN28VLWDlxfbNf%2FF6lXJ%2B2ah7ge%2BH%2FhBdVlZGZrhQglCJXuLQW3RrzXrtaDVxND%2Bv3aZB0c9iMEJeQpKzCoH3gUoPkUcfbMkXT81yUuvR5mmqbEYiN3bcT82eYzoLA2thzDePe2GcUfLD2DinTldmMG%2FjUzNiPfwAVi8e0oSbLA958k0ZAwmHkc%2BmELqKRSdgps7UOKIAFzg2hri6N41Y3O68Q9KS3RGKo%2F%2BhMpnpPLbBcTR%2FStaDau3jM5SZWKHYVhADadQvSmSbB%2Fp6BxUvg%2BefgwlfiILj1YRR9trThsoUcxnV2oKFU6h5RjUecjKozxkoYcs8RCJ4yoPgqDjC0797iLnDdGRrC38gHbCgAZ%2Bu4uMl%2FTGSJMxuB6D200kdhN9NYbNvodbL%2BCEB5fOiHdjEwNRIJcEuSPIKUGuCPKUIB8UO0K7uivuCe0yFpzG%2BmlsFBOT9rbojkl7Miagdgwriq3khDxZ7sd77yBAXx5Xg05dLLa7fr3ZarUasuu36pSGTAZMtJs0aMCpAsqdm488UjPSfeZXJKVm%2FQKM7sPpfXB1ETQLQPMCdL3AKN5LVbyRWV2LDFMQpkCSVpBueFv6hDw7V%2Bhi5QYkP7z88PwryeSX8%2BC2QGILfKgOCHr67uSmycn2TZM78u1akqpIjWip3q2UpvKxr96QG7mxYmXJjb98lZdAme69JV26SmOh4p4jX19RQki7bCyX5LsV97Zk1zO3fiWzcZasXn9teSVKrHROmXgKqo7W%2FgJXM1J5%2Fun5t3zixz%2Bg7BQ2KxBlh%2BTUoMw%2BeLIJlxxeTke%2FX71%2F4SM4Q2D1WQ9LPORZMbF1dnapFYGWZzVlBdx%2FanaWTywtX1NVbLm76NkKaHoHcVRgYAsMdAGqx3DZ%2BUma2MPLP3xW2udgujJh2la2mbb60%2FmSS%2Fdu6W7PyHM%2FN%2BHUcbXhiw6Toeww2Ww1Q8kFa7WYz0POGqLb5UjdLGx98f7fAAAA%2F%2F8BAAD%2F%2F38z9wN6BAAA IP192.243.59.13:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjectlodgesweet.com Fingerprint4B:E6:E5:18:A7:CE:25:B5:28:0A:7D:6A:20:3C:0D:DB:99:06:5D:46 ValidityMon, 29 Apr 2024 08:45:06 GMT - Sun, 28 Jul 2024 08:45:05 GMT
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSy2skRRivXue0XnwsXgQZFgQFmXTPOy6yuMYswbjZh4uvg9SrJ%2BVUdzVV3dOT8RJckD3OwYt66fwm2aCGRf8AF5kEFgmKmYsENOAf4ElYPEqPwegH9T3q9xX8vu9Xn2xlJ6SOjB4vvWlGSmu60Kr51RfeCYJL1VUVZ8PqsNv%2BoN28VLWDlxfbNf%2FF6lXJ%2B2ah7ge%2BH%2FhBdVlZGZrhQglCJXuLQW3RrzXrtaDVxND%2Bv3aZB0c9iMEJeQpKzCoH3gUoPkUcfbMkXT81yUuvR5mmqbEYiN3bcT82eYzoLA2thzDePe2GcUfLD2DinTldmMG%2FjUzNiPfwAVi8e0oSbLA958k0ZAwmHkc%2BmELqKRSdgps7UOKIAFzg2hri6N41Y3O68Q9KS3RGKo%2F%2BhMpnpPLbBcTR%2FStaDau3jM5SZWKHYVhADadQvSmSbB%2Fp6BxUvg%2BefgwlfiILj1YRR9trThsoUcxnV2oKFU6h5RjUecjKozxkoYcs8RCJ4yoPgqDjC0797iLnDdGRrC38gHbCgAZ%2Bu4uMl%2FTGSJMxuB6D200kdhN9NYbNvodbL%2BCEB5fOiHdjEwNRIJcEuSPIKUGuCPKUIB8UO0K7uivuCe0yFpzG%2BmlsFBOT9rbojkl7Miagdgwriq3khDxZ7sd77yBAXx5Xg05dLLa7fr3ZarUasuu36pSGTAZMtJs0aMCpAsqdm488UjPSfeZXJKVm%2FQKM7sPpfXB1ETQLQPMCdL3AKN5LVbyRWV2LDFMQpkCSVpBueFv6hDw7V%2Bhi5QYkP7z88PwryeSX8%2BC2QGILfKgOCHr67uSmycn2TZM78u1akqpIjWip3q2UpvKxr96QG7mxYmXJjb98lZdAme69JV26SmOh4p4jX19RQki7bCyX5LsV97Zk1zO3fiWzcZasXn9teSVKrHROmXgKqo7W%2FgJXM1J5%2Fun5t3zixz%2Bg7BQ2KxBlh%2BTUoMw%2BeLIJlxxeTke%2FX71%2F4SM4Q2D1WQ9LPORZMbF1dnapFYGWZzVlBdx%2FanaWTywtX1NVbLm76NkKaHoHcVRgYAsMdAGqx3DZ%2BUma2MPLP3xW2udgujJh2la2mbb60%2FmSS%2Fdu6W7PyHM%2FN%2BHUcbXhiw6Toeww2Ww1Q8kFa7WYz0POGqLb5UjdLGx98f7fAAAA%2F%2F8BAAD%2F%2F38z9wN6BAAA HTTP/1.1
Host: lodgesweet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Cookie: u_pl=22725681; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; nlec172d9680245553e8052aafbe1bd64a13=[2229329,2229337,2229333,2019380]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 875fb96030c09c4a62954f58638cff14
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| lodgesweet.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSS2skVRS%2BNfYqbnwMbgRpBgQF6VT1Ow4yGGMkGCfzcPC1kPuqzrVv1S3urerqZBUckFn2wo26qXydTFCD6A9wkE5gkKCY3khA8xdcCINLqTbYeqDqnHO%2Fc%2BE733c%2F2c3OSR0ZPVt5y2wrreliq%2BZXX3g3CK5W11WcDavDbvvDdvNq1Q5eXmrX%2FBerb0jeN4t1P%2FD9wA%2Bqq8rK0AwXSxAqOVwKakt%2BrVmvBa0mhvb%2Fvcs8OOpBDM7JU1BiWjn2LkPxCeLo2xXp%2BqlJXno9yjRNjcVAHNyJ%2B7HJY0TzMrQewvjgYhrGna4%2BgIn3Z3RhBv8OMjUl3sMHYPHBBUmwwd6MJ9OQMZh4HPlgAqknUHQCbu5CiVMCcIHrG4ij%2B9eNzenWPygt0SmpPPoTKp%2BSyu%2BXEUffLGs1rN42OkuViR2GYQE1nED1JkiyI6Tbl6DyI%2FD0YyjxM1l8tI442ttw2kCJYra7UhOocAItR6DOQ1Z%2BykMWesgSD5E4q%2FIgCDq%2B4NTvLnHeEB3J2sIPaCcMaOC3u8h4SW%2BENBmB6xG43UFid9BXI9jsB7jNAk54cOmUeDd3MBAFckmQO4KcEuSKIE8J8kGxL7Sru%2BK%2B0C5jwUWuX%2BRGMTZpb5fum7QnYwJqR7Ci2E3OyZOlPt77xwH68qwadOpiqd31681Wq9WQXb9VpzRkMmCi3aRBA04VUO7SbOVtNSXdZ35DUnrWL8DoEZw%2BAldXQLMANC9ANwtsx4epircyq2uRYQrCFEjSCtItb1efk2dnDl2pvAfJT649XHglGf%2B6AG4LJLbAR%2BqYoKfvjW%2BZnOzdMrkj320kqYrUNi3du53SVD721ZtyKzdWrK240Zev8hIoy8O3pUvXaSxU3HPk62UlhLSrxnJJvl9z70h2I3Oby5mNs2T9xmura1FipXPKxBNQdbrxF7iaksrzT8%2Be5RM%2F%2FQFlJ7BZgSg7IRcBZY7Akx24ZM7eGQKr5zMsuYQ8K8a2zuaHWhFoOe8pK%2BD%2B07N5Pba0vE1VsevuoWcroOldxFGBgS0w0AWoHsFlC%2BM0sSfXfvysjM%2FBdGXMtK3sMW31p6XIN2dKl787U%2FLcL004dVZt%2BKLDZCg7TDZbzVBywVot5vOQs4bodjlSNw1bX3zwNwAAAP%2F%2FAQAA%2F%2F%2Bm2lOFegQAAA%3D%3D | 192.243.59.13 | 200 OK | 7 B |
URL GET HTTP/1.1lodgesweet.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSS2skVRS%2BNfYqbnwMbgRpBgQF6VT1Ow4yGGMkGCfzcPC1kPuqzrVv1S3urerqZBUckFn2wo26qXydTFCD6A9wkE5gkKCY3khA8xdcCINLqTbYeqDqnHO%2Fc%2BE733c%2F2c3OSR0ZPVt5y2wrreliq%2BZXX3g3CK5W11WcDavDbvvDdvNq1Q5eXmrX%2FBerb0jeN4t1P%2FD9wA%2Bqq8rK0AwXSxAqOVwKakt%2BrVmvBa0mhvb%2Fvcs8OOpBDM7JU1BiWjn2LkPxCeLo2xXp%2BqlJXno9yjRNjcVAHNyJ%2B7HJY0TzMrQewvjgYhrGna4%2BgIn3Z3RhBv8OMjUl3sMHYPHBBUmwwd6MJ9OQMZh4HPlgAqknUHQCbu5CiVMCcIHrG4ij%2B9eNzenWPygt0SmpPPoTKp%2BSyu%2BXEUffLGs1rN42OkuViR2GYQE1nED1JkiyI6Tbl6DyI%2FD0YyjxM1l8tI442ttw2kCJYra7UhOocAItR6DOQ1Z%2BykMWesgSD5E4q%2FIgCDq%2B4NTvLnHeEB3J2sIPaCcMaOC3u8h4SW%2BENBmB6xG43UFid9BXI9jsB7jNAk54cOmUeDd3MBAFckmQO4KcEuSKIE8J8kGxL7Sru%2BK%2B0C5jwUWuX%2BRGMTZpb5fum7QnYwJqR7Ci2E3OyZOlPt77xwH68qwadOpiqd31681Wq9WQXb9VpzRkMmCi3aRBA04VUO7SbOVtNSXdZ35DUnrWL8DoEZw%2BAldXQLMANC9ANwtsx4epircyq2uRYQrCFEjSCtItb1efk2dnDl2pvAfJT649XHglGf%2B6AG4LJLbAR%2BqYoKfvjW%2BZnOzdMrkj320kqYrUNi3du53SVD721ZtyKzdWrK240Zev8hIoy8O3pUvXaSxU3HPk62UlhLSrxnJJvl9z70h2I3Oby5mNs2T9xmura1FipXPKxBNQdbrxF7iaksrzT8%2Be5RM%2F%2FQFlJ7BZgSg7IRcBZY7Akx24ZM7eGQKr5zMsuYQ8K8a2zuaHWhFoOe8pK%2BD%2B07N5Pba0vE1VsevuoWcroOldxFGBgS0w0AWoHsFlC%2BM0sSfXfvysjM%2FBdGXMtK3sMW31p6XIN2dKl787U%2FLcL004dVZt%2BKLDZCg7TDZbzVBywVot5vOQs4bodjlSNw1bX3zwNwAAAP%2F%2FAQAA%2F%2F%2Bm2lOFegQAAA%3D%3D IP192.243.59.13:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjectlodgesweet.com Fingerprint4B:E6:E5:18:A7:CE:25:B5:28:0A:7D:6A:20:3C:0D:DB:99:06:5D:46 ValidityMon, 29 Apr 2024 08:45:06 GMT - Sun, 28 Jul 2024 08:45:05 GMT
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSS2skVRS%2BNfYqbnwMbgRpBgQF6VT1Ow4yGGMkGCfzcPC1kPuqzrVv1S3urerqZBUckFn2wo26qXydTFCD6A9wkE5gkKCY3khA8xdcCINLqTbYeqDqnHO%2Fc%2BE733c%2F2c3OSR0ZPVt5y2wrreliq%2BZXX3g3CK5W11WcDavDbvvDdvNq1Q5eXmrX%2FBerb0jeN4t1P%2FD9wA%2Bqq8rK0AwXSxAqOVwKakt%2BrVmvBa0mhvb%2Fvcs8OOpBDM7JU1BiWjn2LkPxCeLo2xXp%2BqlJXno9yjRNjcVAHNyJ%2B7HJY0TzMrQewvjgYhrGna4%2BgIn3Z3RhBv8OMjUl3sMHYPHBBUmwwd6MJ9OQMZh4HPlgAqknUHQCbu5CiVMCcIHrG4ij%2B9eNzenWPygt0SmpPPoTKp%2BSyu%2BXEUffLGs1rN42OkuViR2GYQE1nED1JkiyI6Tbl6DyI%2FD0YyjxM1l8tI442ttw2kCJYra7UhOocAItR6DOQ1Z%2BykMWesgSD5E4q%2FIgCDq%2B4NTvLnHeEB3J2sIPaCcMaOC3u8h4SW%2BENBmB6xG43UFid9BXI9jsB7jNAk54cOmUeDd3MBAFckmQO4KcEuSKIE8J8kGxL7Sru%2BK%2B0C5jwUWuX%2BRGMTZpb5fum7QnYwJqR7Ci2E3OyZOlPt77xwH68qwadOpiqd31681Wq9WQXb9VpzRkMmCi3aRBA04VUO7SbOVtNSXdZ35DUnrWL8DoEZw%2BAldXQLMANC9ANwtsx4epircyq2uRYQrCFEjSCtItb1efk2dnDl2pvAfJT649XHglGf%2B6AG4LJLbAR%2BqYoKfvjW%2BZnOzdMrkj320kqYrUNi3du53SVD721ZtyKzdWrK240Zev8hIoy8O3pUvXaSxU3HPk62UlhLSrxnJJvl9z70h2I3Oby5mNs2T9xmura1FipXPKxBNQdbrxF7iaksrzT8%2Be5RM%2F%2FQFlJ7BZgSg7IRcBZY7Akx24ZM7eGQKr5zMsuYQ8K8a2zuaHWhFoOe8pK%2BD%2B07N5Pba0vE1VsevuoWcroOldxFGBgS0w0AWoHsFlC%2BM0sSfXfvysjM%2FBdGXMtK3sMW31p6XIN2dKl787U%2FLcL004dVZt%2BKLDZCg7TDZbzVBywVot5vOQs4bodjlSNw1bX3zwNwAAAP%2F%2FAQAA%2F%2F%2Bm2lOFegQAAA%3D%3D HTTP/1.1
Host: lodgesweet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Cookie: u_pl=22725681; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; nlec172d9680245553e8052aafbe1bd64a13=[2229329,2229337,2229333,2019380]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: b5522706175a47c59e48043a4874bb41
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| lodgesweet.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSzWsk1Rd9NdOr%2FDY%2FdXAjSDMgKEinqr%2FjIIMxRoJxMh8Ofi3kfVXn2a%2FqFe9VdXWyCg7ILHvhRt1UTicT1CD6BzhIJzBIUExvJKD5E9wIg0upNth6oere%2B859cO457%2BPd7JzUkdGzlTfNttKaLrZqfvX5d4LgWnVdxdmwOuy2P2g3r1Xt4KWlds1%2Fofq65H2zWPcD3w%2F8oLqqrAzNcLEEoZLDpaC25Nea9VrQamJo%2F9u7zIOjHsTgnDwJJaaVY%2B8KFJ8gjr5Zka6fmuTF16JM09RYDMTB3bgfmzxGNC9D6yGMDy6mYdzp6kOYeH9GF2bwzyBTU%2BI9eggWH1yQBBvszXgyDRmDif8hH0wg9QSKTsDNPShxSgAucGMDcfTghrE53fobpSU6JZXHf0DlU1L57Qri6OtlrYbVO0ZnqTKxwzAsoIYTqN4ESXaEdPsSVH4Enn4EJX4ii4%2FXEUd7G04bKFHMdldqAhVOoOUI1HnIyk95yEIPWeIhEmdVHgRBxxec%2Bt0lzhuiI1lb%2BAHthAEN%2FHYXGS%2FpjZAmI3A9Arc7SOwO%2BmoEm30Pt1nACQ8unRLv1g4GokAuCXJHkFOCXBHkKUE%2BKPaFdnVXPBDaZSy4yPWL3CjGJu3t0n2T9mRMQO0IVhS7yTl5otTHe%2B84QF%2BeVYNOXSy1u3692Wq1GrLrt%2BqUhkwGTLSbNGjAqQLKXZqtvK2mpPv0r0hKz%2FoFGD2C00fg6ipoFoDmBehmge34MFXxVmZ1LTJMQZgCSVpBuuXt6nPyzMyhq5W7kPzk%2BqOFl5PxLwvgtkBiC3yojgl6%2Bv74tsnJ3m2TO%2FLtRpKqSG3T0r07KU3l5S%2FfkFu5sWJtxY2%2BeIWXQFkeviVduk5joeKeI18tKyGkXTWWS%2FLdmntbspuZ21zObJwl6zdfXV2LEiudUyaegKrTjT%2FB1ZRUnntq9iz%2F%2F%2BPvUHYCmxWIshNyEVDmCDzZgUvm7J0hsHo%2Bw5LLyLNibOtsfqgVgZbznrIC7l89m9djS8vbVBW77j56tgKa3kMcFRjYAgNdgOoRXLYwThN7cv2HT8v4DExXxkzbyh7TVn9Sinyr%2FL07k3tKnv25CafOqg1fdJgMZYfJZqsZSi5Yq8V8HnLWEN0uR%2BqmYevz9%2F8CAAD%2F%2FwEAAP%2F%2FGtZQsnoEAAA%3D | 192.243.59.13 | 200 OK | 7 B |
URL GET HTTP/1.1lodgesweet.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSzWsk1Rd9NdOr%2FDY%2FdXAjSDMgKEinqr%2FjIIMxRoJxMh8Ofi3kfVXn2a%2FqFe9VdXWyCg7ILHvhRt1UTicT1CD6BzhIJzBIUExvJKD5E9wIg0upNth6oere%2B859cO457%2BPd7JzUkdGzlTfNttKaLrZqfvX5d4LgWnVdxdmwOuy2P2g3r1Xt4KWlds1%2Fofq65H2zWPcD3w%2F8oLqqrAzNcLEEoZLDpaC25Nea9VrQamJo%2F9u7zIOjHsTgnDwJJaaVY%2B8KFJ8gjr5Zka6fmuTF16JM09RYDMTB3bgfmzxGNC9D6yGMDy6mYdzp6kOYeH9GF2bwzyBTU%2BI9eggWH1yQBBvszXgyDRmDif8hH0wg9QSKTsDNPShxSgAucGMDcfTghrE53fobpSU6JZXHf0DlU1L57Qri6OtlrYbVO0ZnqTKxwzAsoIYTqN4ESXaEdPsSVH4Enn4EJX4ii4%2FXEUd7G04bKFHMdldqAhVOoOUI1HnIyk95yEIPWeIhEmdVHgRBxxec%2Bt0lzhuiI1lb%2BAHthAEN%2FHYXGS%2FpjZAmI3A9Arc7SOwO%2BmoEm30Pt1nACQ8unRLv1g4GokAuCXJHkFOCXBHkKUE%2BKPaFdnVXPBDaZSy4yPWL3CjGJu3t0n2T9mRMQO0IVhS7yTl5otTHe%2B84QF%2BeVYNOXSy1u3692Wq1GrLrt%2BqUhkwGTLSbNGjAqQLKXZqtvK2mpPv0r0hKz%2FoFGD2C00fg6ipoFoDmBehmge34MFXxVmZ1LTJMQZgCSVpBuuXt6nPyzMyhq5W7kPzk%2BqOFl5PxLwvgtkBiC3yojgl6%2Bv74tsnJ3m2TO%2FLtRpKqSG3T0r07KU3l5S%2FfkFu5sWJtxY2%2BeIWXQFkeviVduk5joeKeI18tKyGkXTWWS%2FLdmntbspuZ21zObJwl6zdfXV2LEiudUyaegKrTjT%2FB1ZRUnntq9iz%2F%2F%2BPvUHYCmxWIshNyEVDmCDzZgUvm7J0hsHo%2Bw5LLyLNibOtsfqgVgZbznrIC7l89m9djS8vbVBW77j56tgKa3kMcFRjYAgNdgOoRXLYwThN7cv2HT8v4DExXxkzbyh7TVn9Sinyr%2FL07k3tKnv25CafOqg1fdJgMZYfJZqsZSi5Yq8V8HnLWEN0uR%2BqmYevz9%2F8CAAD%2F%2FwEAAP%2F%2FGtZQsnoEAAA%3D IP192.243.59.13:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjectlodgesweet.com Fingerprint4B:E6:E5:18:A7:CE:25:B5:28:0A:7D:6A:20:3C:0D:DB:99:06:5D:46 ValidityMon, 29 Apr 2024 08:45:06 GMT - Sun, 28 Jul 2024 08:45:05 GMT
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSzWsk1Rd9NdOr%2FDY%2FdXAjSDMgKEinqr%2FjIIMxRoJxMh8Ofi3kfVXn2a%2FqFe9VdXWyCg7ILHvhRt1UTicT1CD6BzhIJzBIUExvJKD5E9wIg0upNth6oere%2B859cO457%2BPd7JzUkdGzlTfNttKaLrZqfvX5d4LgWnVdxdmwOuy2P2g3r1Xt4KWlds1%2Fofq65H2zWPcD3w%2F8oLqqrAzNcLEEoZLDpaC25Nea9VrQamJo%2F9u7zIOjHsTgnDwJJaaVY%2B8KFJ8gjr5Zka6fmuTF16JM09RYDMTB3bgfmzxGNC9D6yGMDy6mYdzp6kOYeH9GF2bwzyBTU%2BI9eggWH1yQBBvszXgyDRmDif8hH0wg9QSKTsDNPShxSgAucGMDcfTghrE53fobpSU6JZXHf0DlU1L57Qri6OtlrYbVO0ZnqTKxwzAsoIYTqN4ESXaEdPsSVH4Enn4EJX4ii4%2FXEUd7G04bKFHMdldqAhVOoOUI1HnIyk95yEIPWeIhEmdVHgRBxxec%2Bt0lzhuiI1lb%2BAHthAEN%2FHYXGS%2FpjZAmI3A9Arc7SOwO%2BmoEm30Pt1nACQ8unRLv1g4GokAuCXJHkFOCXBHkKUE%2BKPaFdnVXPBDaZSy4yPWL3CjGJu3t0n2T9mRMQO0IVhS7yTl5otTHe%2B84QF%2BeVYNOXSy1u3692Wq1GrLrt%2BqUhkwGTLSbNGjAqQLKXZqtvK2mpPv0r0hKz%2FoFGD2C00fg6ipoFoDmBehmge34MFXxVmZ1LTJMQZgCSVpBuuXt6nPyzMyhq5W7kPzk%2BqOFl5PxLwvgtkBiC3yojgl6%2Bv74tsnJ3m2TO%2FLtRpKqSG3T0r07KU3l5S%2FfkFu5sWJtxY2%2BeIWXQFkeviVduk5joeKeI18tKyGkXTWWS%2FLdmntbspuZ21zObJwl6zdfXV2LEiudUyaegKrTjT%2FB1ZRUnntq9iz%2F%2F%2BPvUHYCmxWIshNyEVDmCDzZgUvm7J0hsHo%2Bw5LLyLNibOtsfqgVgZbznrIC7l89m9djS8vbVBW77j56tgKa3kMcFRjYAgNdgOoRXLYwThN7cv2HT8v4DExXxkzbyh7TVn9Sinyr%2FL07k3tKnv25CafOqg1fdJgMZYfJZqsZSi5Yq8V8HnLWEN0uR%2BqmYevz9%2F8CAAD%2F%2FwEAAP%2F%2FGtZQsnoEAAA%3D HTTP/1.1
Host: lodgesweet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Cookie: u_pl=22725681; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; nlec172d9680245553e8052aafbe1bd64a13=[2229329,2229337,2229333,2019380]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 26923ff821a55b5c9f787f362c2bcfc7
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| lodgesweet.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSTWskRRiuXucUQVAXL4IMC4KKTLrnOy6yGGMkGDf74eLXQeqrJ%2BVUdzVV3dOTnIILssc5eFEvnWeSDWoQ%2FQEuMgksEhAzFwlo%2FoSweJSeDY6%2BUO9HPW%2FB875Pfb6bnZM6Mnq28q7ZVlrTxVbNr770QRBcra6rOBtWh932J%2B3m1aodvLbUrvkvV9%2BWvG8W637g%2B4EfVFeVlaEZLpYgVHK4FNSW%2FFqzXgtaTQzt%2F2uXeXDUgxick2egxLRy7F2G4hPE0Q8r0vVTk7z6VpRpmhqLgTi4E%2Fdjk8eI5mloPYTxwUU3jDtdfQAT78%2Fowgz%2BbWRqSryHD8DigwuSYIO9GU%2BmIWMw8STywQRST6DoBNzchRKnBOAC1zcQR%2FevG5vTrccoLdEpqTz6CyqfksqflxFH3y9rNazeNjpLlYkdhmEBNZxA9SZIsiOk25eg8iPw9DMo8StZfLSOONrbcNpAiWI2u1ITqHACLUegzkNWHuUhCz1kiYdInFV5EAQdX3Dqd5c4b4iOZG3hB7QTBjTw211kvKQ3QpqMwPUI3O4gsTvoqxFs9jPcZgEnPLh0SrybOxiIArkkyB1BTglyRZCnBPmg2Bfa1V1xX2iXseAi1i9ioxibtLdL903akzEBtSNYUewm5%2BTpcj%2FeR8cB%2BvKsGnTqYqnd9evNVqvVkF2%2FVac0ZDJgot2kQQNOFVDu0mzkbTUl3ef%2BQFJq1i%2FA6BGcPgJXV0CzADQvQDcLbMeHqYq3MqtrkWEKwhRI0grSLW9Xn5PnZwq98FsTkp9ce7jwejL%2BfQHcFkhsgU%2FVMUFP3xvfMjnZu2VyR37cSFIVqW1aqnc7pal84tt35FZurFhbcaNv3uAlUKaH70mXrtNYqLjnyHfLSghpV43lkvy05t6X7EbmNpczG2fJ%2Bo03V9eixErnlIknoOp0429wNSWVF5%2BdfcunTl%2BBshPYrECUnZALgzJH4MkOXDJn7wyB1fMellSQZ8XY1tn8UisCLec1ZQXcf2o2z8eWlq%2BpKnbdPfRsBTS9izgqMLAFBroA1SO4bGGcJvbk2i9flvYVmK6MmbaVPaat%2FmJKrlRulu7D0t15vHOnzqoNX3SYDGWHyWarGUouWKvFfB5y1hDdLkfqpmHr64%2F%2FAQAA%2F%2F8BAAD%2F%2F1GiJPZ6BAAA | 192.243.59.13 | 200 OK | 7 B |
URL GET HTTP/1.1lodgesweet.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSTWskRRiuXucUQVAXL4IMC4KKTLrnOy6yGGMkGDf74eLXQeqrJ%2BVUdzVV3dOTnIILssc5eFEvnWeSDWoQ%2FQEuMgksEhAzFwlo%2FoSweJSeDY6%2BUO9HPW%2FB875Pfb6bnZM6Mnq28q7ZVlrTxVbNr770QRBcra6rOBtWh932J%2B3m1aodvLbUrvkvV9%2BWvG8W637g%2B4EfVFeVlaEZLpYgVHK4FNSW%2FFqzXgtaTQzt%2F2uXeXDUgxick2egxLRy7F2G4hPE0Q8r0vVTk7z6VpRpmhqLgTi4E%2Fdjk8eI5mloPYTxwUU3jDtdfQAT78%2Fowgz%2BbWRqSryHD8DigwuSYIO9GU%2BmIWMw8STywQRST6DoBNzchRKnBOAC1zcQR%2FevG5vTrccoLdEpqTz6CyqfksqflxFH3y9rNazeNjpLlYkdhmEBNZxA9SZIsiOk25eg8iPw9DMo8StZfLSOONrbcNpAiWI2u1ITqHACLUegzkNWHuUhCz1kiYdInFV5EAQdX3Dqd5c4b4iOZG3hB7QTBjTw211kvKQ3QpqMwPUI3O4gsTvoqxFs9jPcZgEnPLh0SrybOxiIArkkyB1BTglyRZCnBPmg2Bfa1V1xX2iXseAi1i9ioxibtLdL903akzEBtSNYUewm5%2BTpcj%2FeR8cB%2BvKsGnTqYqnd9evNVqvVkF2%2FVac0ZDJgot2kQQNOFVDu0mzkbTUl3ef%2BQFJq1i%2FA6BGcPgJXV0CzADQvQDcLbMeHqYq3MqtrkWEKwhRI0grSLW9Xn5PnZwq98FsTkp9ce7jwejL%2BfQHcFkhsgU%2FVMUFP3xvfMjnZu2VyR37cSFIVqW1aqnc7pal84tt35FZurFhbcaNv3uAlUKaH70mXrtNYqLjnyHfLSghpV43lkvy05t6X7EbmNpczG2fJ%2Bo03V9eixErnlIknoOp0429wNSWVF5%2BdfcunTl%2BBshPYrECUnZALgzJH4MkOXDJn7wyB1fMellSQZ8XY1tn8UisCLec1ZQXcf2o2z8eWlq%2BpKnbdPfRsBTS9izgqMLAFBroA1SO4bGGcJvbk2i9flvYVmK6MmbaVPaat%2FmJKrlRulu7D0t15vHOnzqoNX3SYDGWHyWarGUouWKvFfB5y1hDdLkfqpmHr64%2F%2FAQAA%2F%2F8BAAD%2F%2F1GiJPZ6BAAA IP192.243.59.13:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subjectlodgesweet.com Fingerprint4B:E6:E5:18:A7:CE:25:B5:28:0A:7D:6A:20:3C:0D:DB:99:06:5D:46 ValidityMon, 29 Apr 2024 08:45:06 GMT - Sun, 28 Jul 2024 08:45:05 GMT
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSTWskRRiuXucUQVAXL4IMC4KKTLrnOy6yGGMkGDf74eLXQeqrJ%2BVUdzVV3dOTnIILssc5eFEvnWeSDWoQ%2FQEuMgksEhAzFwlo%2FoSweJSeDY6%2BUO9HPW%2FB875Pfb6bnZM6Mnq28q7ZVlrTxVbNr770QRBcra6rOBtWh932J%2B3m1aodvLbUrvkvV9%2BWvG8W637g%2B4EfVFeVlaEZLpYgVHK4FNSW%2FFqzXgtaTQzt%2F2uXeXDUgxick2egxLRy7F2G4hPE0Q8r0vVTk7z6VpRpmhqLgTi4E%2Fdjk8eI5mloPYTxwUU3jDtdfQAT78%2Fowgz%2BbWRqSryHD8DigwuSYIO9GU%2BmIWMw8STywQRST6DoBNzchRKnBOAC1zcQR%2FevG5vTrccoLdEpqTz6CyqfksqflxFH3y9rNazeNjpLlYkdhmEBNZxA9SZIsiOk25eg8iPw9DMo8StZfLSOONrbcNpAiWI2u1ITqHACLUegzkNWHuUhCz1kiYdInFV5EAQdX3Dqd5c4b4iOZG3hB7QTBjTw211kvKQ3QpqMwPUI3O4gsTvoqxFs9jPcZgEnPLh0SrybOxiIArkkyB1BTglyRZCnBPmg2Bfa1V1xX2iXseAi1i9ioxibtLdL903akzEBtSNYUewm5%2BTpcj%2FeR8cB%2BvKsGnTqYqnd9evNVqvVkF2%2FVac0ZDJgot2kQQNOFVDu0mzkbTUl3ef%2BQFJq1i%2FA6BGcPgJXV0CzADQvQDcLbMeHqYq3MqtrkWEKwhRI0grSLW9Xn5PnZwq98FsTkp9ce7jwejL%2BfQHcFkhsgU%2FVMUFP3xvfMjnZu2VyR37cSFIVqW1aqnc7pal84tt35FZurFhbcaNv3uAlUKaH70mXrtNYqLjnyHfLSghpV43lkvy05t6X7EbmNpczG2fJ%2Bo03V9eixErnlIknoOp0429wNSWVF5%2BdfcunTl%2BBshPYrECUnZALgzJH4MkOXDJn7wyB1fMellSQZ8XY1tn8UisCLec1ZQXcf2o2z8eWlq%2BpKnbdPfRsBTS9izgqMLAFBroA1SO4bGGcJvbk2i9flvYVmK6MmbaVPaat%2FmJKrlRulu7D0t15vHOnzqoNX3SYDGWHyWarGUouWKvFfB5y1hDdLkfqpmHr64%2F%2FAQAA%2F%2F8BAAD%2F%2F1GiJPZ6BAAA HTTP/1.1
Host: lodgesweet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Cookie: u_pl=22725681; pdhtkv=true; uncs=1; pdhtkv49=true; uncs49=1; nlec172d9680245553e8052aafbe1bd64a13=[2229329,2229337,2229333,2019380]
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 04 May 2024 02:20:11 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 3ab94066712a7f6b1e03f18e5a474902
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| unseenreport.com/pxf.gif?uuid=618d663e-f8d5-4c45-a0b2-22a33ee384d6&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=7866ead300fcf9e425beaf01fe308949&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=2 | 192.243.61.225 | 200 OK | 1 B |
URL GET HTTP/1.1unseenreport.com/pxf.gif?uuid=618d663e-f8d5-4c45-a0b2-22a33ee384d6&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=7866ead300fcf9e425beaf01fe308949&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=2 IP192.243.61.225:443 ASN#39572 DataWeb Global Group B.V.
CertificateIssuerLet's Encrypt Subject*.unseenreport.com Fingerprint71:46:15:FD:76:6A:F5:5B:51:06:CC:93:DD:D8:63:E3:8B:10:BF:13 ValidityFri, 22 Mar 2024 07:32:41 GMT - Thu, 20 Jun 2024 07:32:40 GMT
File typevery short file (no magic) Hash93b885adfe0da089cdf634904fd59f71 5ba93c9db0cff93f52b521d7420e43f6eda2784f 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pxf.gif?uuid=618d663e-f8d5-4c45-a0b2-22a33ee384d6&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=7866ead300fcf9e425beaf01fe308949&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=2 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 04 May 2024 02:20:12 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 38b02dff748949fb7c9c22976d08a9f0
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| | 185.11.100.204 | 301 Moved Permanently | 14 kB |
URL User Request GET HTTP/2IP185.11.100.204:443 ASN#29522 Cyber_Folks S.A.
CertificateIssuerLet's Encrypt Subjectbitly.ws Fingerprint2E:32:BE:AA:55:57:6D:B9:D0:4B:B5:E4:B8:69:A8:99:AF:37:26:88 ValidityThu, 02 May 2024 22:01:15 GMT - Wed, 31 Jul 2024 22:01:14 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?redirect=32ECJ HTTP/1.1
Host: bitly.ws
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Sat, 04 May 2024 02:20:09 GMT
server: Apache
x-powered-by: PHP/5.5.38
location: https://zip.lu?banned=1
cache-control: max-age=0
expires: Sat, 04 May 2024 02:20:09 GMT
content-type: text/html
X-Firefox-Spdy: h2
|
|
| pl22826180.profitablegatecpm.com/172d9680245553e8052aafbe1bd64a13/invoke.js | 172.240.108.68 | 200 OK | 27 kB |
URL GET HTTP/1.1pl22826180.profitablegatecpm.com/172d9680245553e8052aafbe1bd64a13/invoke.js IP172.240.108.68:443
CertificateIssuerLet's Encrypt Subjectprofitablegatecpm.com Fingerprint9D:FB:8C:AD:4D:64:98:6B:85:78:33:54:E7:A3:BB:10:ED:77:63:30 ValidityFri, 05 Apr 2024 18:10:33 GMT - Thu, 04 Jul 2024 18:10:32 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /172d9680245553e8052aafbe1bd64a13/invoke.js HTTP/1.1
Host: pl22826180.profitablegatecpm.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 04 May 2024 02:20:10 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: f6fbffda6b57d3b3b103929d6184876c
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| downstairsnegotiatebarren.com/sfp.js |  104.21.35.227 | 200 OK | 86 kB |
URL GET HTTP/2downstairsnegotiatebarren.com/sfp.js IP104.21.35.227:443
CertificateIssuerLet's Encrypt Subjectdownstairsnegotiatebarren.com Fingerprint5D:DB:CB:C6:CE:2A:8B:34:7D:BC:43:74:33:1D:5F:77:48:F7:BC:1B ValidityThu, 02 May 2024 21:26:34 GMT - Wed, 31 Jul 2024 21:26:33 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sfp.js HTTP/1.1
Host: downstairsnegotiatebarren.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zip.lu/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 04 May 2024 02:20:11 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: a16b3002e9963dec4c93843e052aa160
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Sat, 04 May 2024 02:20:07 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IkATqJYDKKo3Exyr7mGuwiN9GCBE8hUB%2Bp6TuNiXTyAG4jK9gdbP1D%2B5uWBUC2eK%2FY8fkj79FpCnPW%2BCmo7ay1Tbqxw6qV2UszH4BDqXD64dvbk5J1h116kVpXbiEZKAJhsnB24VpuzZpApoNyzyPg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87e50299cab0568a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
0.0.0.0