200 OK 13 kB URL User Request GET HTTP/1.1 IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (672), with CRLF, LF line terminators
Hash 733b027e424154c690bf17789e9f4dc9
85df4633e9d81df8a579d97f731611591b516181
7eeae6a756c6788f98bbd5d84f065c1cf8ebc33893496276cf1050fbc8e74744
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET / HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:30 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding, Accept-Encoding
cache-control: no-cache, private
set-cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; path=/; httponly
SRVNAME=62; path=/
age: 0
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mRuftWiIS1VdUzTJp0TK%2BSkou0FvQqsfwi7N9pdTOWo%2BHKk9ZsA0pjk4fb5s1qLZn7VrHT3zPRfjgLFOLqONzOIxQCi7%2FItkD94rktxJNVWMaroxCDLjytELZAYDKyni5g%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb36afd01a02d-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
www.googletagmanager.com/gtag/js?id=G-KZN5DGMJK9
200 OK 93 kB URL GET HTTP/2 www.googletagmanager.com/gtag/js?id=G-KZN5DGMJK9
IP
Certificate IssuerGoogle Trust Services LLC
Subject*.google-analytics.com
Fingerprint37:42:10:B7:89:70:45:51:80:81:66:CE:95:21:72:5D:46:0B:E2:34
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
File type ASCII text, with very long lines (5955)
Hash 57eb87a2fe65a8fcf4185d9ecce11b8b
1db74096a3a0198ef5b47aa1963e28eed1388c6e
7db4d6618959d072a090751a6fd564f60f4c1ac1a7e07e3aba44eee640cc8f2d
GET /gtag/js?id=G-KZN5DGMJK9 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 03 Dec 2023 23:48:31 GMT
expires: Sun, 03 Dec 2023 23:48:31 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 92985
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
174.138.31.128/assets/css/vendor/animate/animate.min.css
200 OK 3.2 kB URL GET HTTP/1.1 174.138.31.128/assets/css/vendor/animate/animate.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (41627), with no line terminators
Hash 334a08b5bde1604891f36f67d344f9ba
115b9cc3d3042eff4cef5f8d67ca7f0f8de9c21f
e5fbca3a78b54f9bf7ef5a205a5d6264b74e8026943ce6523b214d4bacf78761
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/css/vendor/animate/animate.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:31 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 08:10:18 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"650bfa6a-a29b"
expires: Tue, 02 Jan 2024 23:48:31 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y1Vb0ovZIa68BJr7cvBg%2BVH7kHMzz7h9RGMqBytvgCAyc%2BDgqnPd495%2F%2BbDTwMgoIbcCSi75ckjY2HC6m4pTZVnm9p1LsbF42FgfLDFxyd4fxEWLypUW28FzNkbNA4%2BGzw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb373eebd3da5-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/css/vendor/bootstrap-checkbox.min.css
200 OK 1.2 kB URL GET HTTP/1.1 174.138.31.128/assets/css/vendor/bootstrap-checkbox.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (6736), with no line terminators
Hash 6bdcb8b453b5fe3fc7f82b0c5798ec91
bb7bfba0ce22de9dd76d7dd71ea0f99943ca916c
bcc36e6dfb15f4c5b87dff41e7f4007cc49b1bd0c460ac5d5e818b4e3a97b2cb
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/css/vendor/bootstrap-checkbox.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 08:07:44 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"650bf9d0-1a50"
expires: Sun, 31 Dec 2023 18:27:17 GMT
cache-control: public, max-age=2592000, no-transform
age: 192075
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mYqamD5SHQg40TWlrRpWWRxUBf18zkQY0Ot5ANvfOHewsDWwStXj8r4mDi6vQYMCbsX2NK9%2F1X3JA5dowvRfDf9OFrcTkL%2FhEp6CCcxB%2FKfFKMoNrKMGPuhFt8RKVpQ2kA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3741f65a083-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/css/vendor/ribbons/3d-corner-ribbons.min.css
200 OK 1.1 kB URL GET HTTP/1.1 174.138.31.128/assets/css/vendor/ribbons/3d-corner-ribbons.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (5366), with no line terminators
Hash 02cc0d0020f373e1247ee9e7c2e7ca04
0ed6d3399c1abf1feecf4bbf59c517fd055a2678
7cf0b8467b88360e4e11881a231c013464a4fe2c449887baa7fde731a7058845
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/css/vendor/ribbons/3d-corner-ribbons.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 08:10:18 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"650bfa6a-14f6"
expires: Tue, 02 Jan 2024 23:48:32 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B4VbU%2Bo3tyyUgaHQtTCnvbT7ag75CIZQhj4BQSKyw9dpXVUrLrdqn7vKo5YyRe%2Bbh9xgHdup3n9otK%2F25iId75zwGvAYSqlOszhURcoYLhxMo6UbXISJOjpquHz1guVseg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb373faa55fbd-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/text-rotator/css/simpletextrotator.min.css
200 OK 480 B URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/text-rotator/css/simpletextrotator.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (2879), with no line terminators
Hash 8123083f5ecbef7842b43e487d06207f
6ed548348f7049edcf10594f3e84533c272a64aa
e58260e204b97def3d0cb7c8f11c0ddb7e2255eb43f20c05cd9578dd3b6a31d9
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/text-rotator/css/simpletextrotator.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-b3f"
expires: Tue, 02 Jan 2024 23:48:32 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XWwTxsg8CznPKZFQUvZP%2FTkJz9J%2B9%2B7fFYhExAJB6Tpd%2BM%2BUtAqy7dzEzpKh1BgKMskzxbSO3EQW8xW%2BNl6JsbuNSxlhg3Co9AeJiZF3hRTBauKNUlQkz44%2FgB%2FppEZYcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3741ce96b99-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/css/font-awesome.min.css
200 OK 7.1 kB URL GET HTTP/1.1 174.138.31.128/assets/css/font-awesome.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (30837)
Hash 269550530cc127b6aa5a35925a7de6ce
512c7d79033e3028a9be61b540cf1a6870c896f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/css/font-awesome.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:31 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 08:11:01 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"650bfa95-7918"
expires: Tue, 12 Dec 2023 22:23:23 GMT
cache-control: public, max-age=2592000, no-transform
age: 1819508
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kf3X25Af6I2GREDR3yBSkzVzUa51QV3cTqOWFOnUT%2BTNBR9SFmLSuc5FzVp0gzb9Nz2FljmhbueCH%2BrwsYxaGLsK%2BYrQRokCD6dd5HOnMT0YLKd9Q7TqSObLBBP6SAM1lw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb373bd6c4957-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/css/fonts.min.css
200 OK 752 B URL GET HTTP/1.1 174.138.31.128/assets/css/fonts.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (3268), with no line terminators
Hash 389b48589b4a792d84001fd40e21ba30
76dfd7fb03f4d2cc79bd001bd4b2bf3b17983d39
9531877a395471eb20e85f9e742bf48cde70d1e528d9aaa55c1c210fb3dbf811
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/css/fonts.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 08:07:44 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"650bf9d0-cc4"
expires: Tue, 02 Jan 2024 14:34:52 GMT
cache-control: public, max-age=2592000, no-transform
age: 33220
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PgDGBaWiUO7dytxOGphNdbxPvdIu3ZXOcb%2B5jhto%2Fu6naPQUNwRqhmYK0efU7qv%2BrG4%2FmsbkmeoQDQcctVgSjVfDLtfXFR8on01DjcCerxNcU5yjph6UOkH0fTuKUdIoww%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3756f136590-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/tabdrop/css/tabdrop.min.css
200 OK 197 B URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/tabdrop/css/tabdrop.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
Hash 977b638a903b1ca1a9f596965b80f0f0
e5b9d1f3658ddf0fa0df67c2a02b5d0b371ac078
61e4384b213f36a3a7fc08b44510fd439ecf3c8523b8633f723fb1012d2fbfbf
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/tabdrop/css/tabdrop.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Content-Length: 197
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
etag: "6466f465-c5"
expires: Tue, 02 Jan 2024 23:48:32 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DEbBXx5stNnlC94cg%2B%2B7H2STwVuMwfgDYpG4F37NhFVbrgTmgydS5ePZl38VjyXKY91HLR%2BrSKDHjhgr%2BicWERFuzWpWCCU%2Bvi3zcm6cC2CDjC3%2FFHHV9y7mnq967XD0BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3754a6444b5-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/js/vendor/owl-carousel/css/owl.carousel.min.css
200 OK 397 B URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/owl-carousel/css/owl.carousel.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (1162), with no line terminators
Hash 47bd8d7d97301b6bd302b87c4ecb7d14
cb31d86b811d053fd3dbf064b7da1e5382d49785
6f78df7d3286f40fde31a16161673e4ea46ccc4fd7845eb84f5e9eb4219f235d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/owl-carousel/css/owl.carousel.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-48a"
expires: Tue, 02 Jan 2024 23:48:32 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RgPWLAcqkotFkArWhc1ad1lK%2FK7u91QxtSQ1Bn3MKvBAwVvpP%2BDPpDHYnPF2PMTVuFRoDxNoSfKjrTOXf4SmHnOwKVkgJFeV9oskzGgxxP9tueWhtIHbrVtevK0iWRcaAw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3755c2e9f95-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/owl-carousel/css/owl.theme.min.css
200 OK 400 B URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/owl-carousel/css/owl.theme.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (1120), with no line terminators
Hash fbef52f73346a99cc02bdfd70904191b
9a738af7e107f52c59c0bad2d7e8ae9c548b38f4
f0a11eb1d8fabf95360258de73cf1cd91360c3b97c1ba92d7744e5eaa40f49d1
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/owl-carousel/css/owl.theme.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-460"
expires: Mon, 01 Jan 2024 00:57:11 GMT
cache-control: public, max-age=2592000, no-transform
age: 168681
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QE2LZSxyseOkA%2FuDZf2pMn%2Fnw03CVU1X2U5BSUFlA5Kik0Mhy3laSVpeIyL6mMHqedVZBdgBim7tgHjHdAPXBCPAQlvrYl293Y0dP2dhpAV%2FMzZbks%2FVdJKMBgiomoo4eA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb375893c3fc2-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/owl-carousel/css/owl.transitions.min.css
200 OK 578 B URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/owl-carousel/css/owl.transitions.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (3699), with no line terminators
Hash d3cae09d3a2a739d57ba673b3c84db71
01ad3c7c272be1c23a796cf247bc1b689f9e7b7c
df344411eb3c7585c6398e1b38475fcc3040ccdc4007ed707734d46e3a50843e
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/owl-carousel/css/owl.transitions.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-e73"
expires: Sun, 31 Dec 2023 12:40:41 GMT
cache-control: public, max-age=2592000, no-transform
age: 212871
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JqrIPx%2F3cHPN5gqLt%2BhgOmOkHvRv%2BqAD58uYHZA6C7ZKUkw2w3BHtaWoCimCY2fX3fjA%2BS4WA5JW9jYGNGdO%2B%2Bp4AHA8D%2Bnxtmv9Sqdvkq7k43s2pHBCMvbSlX6tnYDcgg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3761fae5fec-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/nivo-lightbox/css/nivo-lightbox.min.css
200 OK 830 B URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/nivo-lightbox/css/nivo-lightbox.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (4509), with no line terminators
Hash 4750224fdc2dd0cf143592379f97bb0e
efbf2ca2420b699406aae8459c65b31dc5f8fc18
75beb6ea66cfacbbad808671aa6b753ef5c5bf4e8d5efb9adf9cb840379ed803
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/nivo-lightbox/css/nivo-lightbox.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-119d"
expires: Fri, 29 Dec 2023 04:16:31 GMT
cache-control: public, max-age=2592000, no-transform
age: 415921
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3d6WLJ0s43Ei4JI2XONEKecUP%2BTrh9XpT5dAWxo%2FGKaCXJFPbuCjGLlv55EbvhHoaxI5DCGGveXkZtARMcl5UHIKDPJR5FocjIibHNmcoxhT7DFwYOT%2FW5wNNgHKjyRIbA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb376bba04c53-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/nivo-lightbox/css/themes/default/default.min.css
200 OK 617 B URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/nivo-lightbox/css/themes/default/default.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (2270), with no line terminators
Hash 951401cca4be1f9fca7ce0b7f26a7d8a
2bf014557c6e054e32474fc0d4a69310bc2e4e6f
bdb49593241ac3b4ffa1a72798effc086924f32ee7ae14c27002c9ff32600090
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/nivo-lightbox/css/themes/default/default.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:06:16 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f5b8-8de"
expires: Sat, 30 Dec 2023 21:27:03 GMT
cache-control: public, max-age=2592000, no-transform
age: 267689
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3pNxpdO7m9FedPoLZoZxSliL2U6t8cDraAvvx1iaksUQ3Xn9E5D8xKjFT0s%2BVYJhw5ETxgmkCsAjq%2BGaxwkDnfPbl1JqOMrDbRDgd%2BMsMVmQGcwRlT3zlpdCdD1IqzLVjw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb376a9603f54-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/css/bank.min.css
200 OK 962 B URL GET HTTP/1.1 174.138.31.128/css/bank.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (4885), with no line terminators
Hash b190c77dfa87c2fa9d0c055e7db34140
909ed0e15569be2f3299e8e68dd7ce0195ccbd67
ce416742adf00033170694298361d4824de9c49c9c0f66137190811ee11e53f6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /css/bank.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:06:16 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f5b8-1315"
expires: Tue, 02 Jan 2024 14:59:23 GMT
cache-control: public, max-age=2592000, no-transform
age: 31749
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gYRhr03T76iDmv3%2BVrxl8xcKlwVJ0MCjlNParAoDkFSVwXa53Q8yf%2B5mU%2Fdzn2yxWlaHyZuVaIhDvXYLLx2%2B4T2ffbSHd0qM9ozNFCRShyrxzMzxzl%2ByMJAZ2XaTSrR4zg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb376a8454023-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/css/shio_svg.min.css
200 OK 243 B URL GET HTTP/1.1 174.138.31.128/css/shio_svg.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (1716), with no line terminators
Hash c3d8c757360e573efac45bee5ac7712b
53d1c35e260b2723e5f127941a53c5631ea1030e
c3d46f64e06d98e5d467a140ac28d8fe3f17eeb0b05f6afbf3a4742bfbe48581
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /css/shio_svg.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-6b4"
expires: Mon, 01 Jan 2024 02:00:40 GMT
cache-control: public, max-age=2592000, no-transform
age: 164872
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FUPiBMyYnCD8nnvu00CebZ5WxDoOhQPWtu7IxG36mEa5vfpACPNcmindA3BFMZeEE9cfMCsQS327ZEDc22Zh7e%2FHRVg8kAfNpVvmV1w8LxjGnuk%2BxMlvVZOotlgg1VIlPg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb376e9aa3dab-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/css/marquee.css?v=1701647310
200 OK 674 B URL GET HTTP/1.1 174.138.31.128/css/marquee.css?v=1701647310
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
Hash 6ccc75e363025d110b5985afa3187b43
25460557a798bd582563b4a937bd8e818396c4b7
2d2a7ab1708e5aeee4123d037d8484e9e4c3cca489b4b6b3b931143911403134
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /css/marquee.css?v=1701647310 HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-89f"
expires: Tue, 02 Jan 2024 23:48:32 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9ossgQM4UmSbL%2Btrra%2FGZz%2FIPKGTpX6055sRW%2F6ndlcfPTHU8teOTOMOsk2Fa%2FAJ%2BUP1XblSGr4YdgACQxru0bH%2BQx2v8AwfZkw0%2BnBcwW%2FFRJ5woiLteNAlMjnSo0ijiw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3774ac83d95-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/css/game_compressed_ic.min.css
200 OK 488 B URL GET HTTP/1.1 174.138.31.128/assets/css/game_compressed_ic.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (2454), with no line terminators
Hash 0bd86602b88b341a1e8dd1736a99ae39
f7c937a26328c981dd6741251c0d2320567644d7
544b151ad8c7487ebcaa8538d1c3c18b2a100720d6fe9ef6ab74fa93d5c638b6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/css/game_compressed_ic.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 08:07:44 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"650bf9d0-996"
expires: Sat, 30 Dec 2023 04:34:37 GMT
cache-control: public, max-age=2592000, no-transform
age: 328435
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N%2BBdaKFgNKH4GwklhGTdVVOW5iuP4QOCLVQrliRhsemL77q3yBXKJWaiOjsfbk9Or%2B5ww5xZytK%2BjJAtcDSFAnAiDB9R%2B8qBcOT%2BQ0gkeXRRxwvRxIcE6ENy%2FHklr3RVsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb377e8ec4485-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/css/defaultTheme.min.css
200 OK 514 B URL GET HTTP/1.1 174.138.31.128/assets/css/defaultTheme.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (769)
Hash 18d19892d13e212c46e81ac3d66b78b7
88fdb09c89c08831f9ce0c5a2876f16225dbe01d
e8a7b2ed05fcc0a064737d127e166f8e81781b746b70d8e9aeff7ad0b055464c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/css/defaultTheme.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 08:07:44 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"650bf9d0-49c"
expires: Tue, 19 Dec 2023 07:14:48 GMT
cache-control: public, max-age=2592000, no-transform
age: 1269224
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=67C2XRx8%2B8aed3jVoQnOcIDwyZfCG8aPQzdjZMIbDMor5mLVR8fS6VYDHktUcKIcclBO%2FPt0Twvx9vAcNyr1A2dBA0m64YmBvtsHwzOG1OPoYxItQfh6swytMXsdDznaGg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3780a4f5fbb-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/css/style.min.css
200 OK 566 B URL GET HTTP/1.1 174.138.31.128/assets/css/style.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (1349), with no line terminators
Hash 64ace5290a406bfd18d24f74f84f5dff
586128a261e1b1bc3c3e566584d1b48cce07aa19
41394d817f909ea1d7d35a3652e3d1a661731ba3380312d55f637cb9b5de7c70
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/css/style.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 08:11:01 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"650bfa95-545"
expires: Tue, 02 Jan 2024 19:54:39 GMT
cache-control: public, max-age=2592000, no-transform
age: 14033
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r6ll64JyIiIz7MqKpSYB5JZ4A65hWvzB4xABNMacSiB93S%2FYJmhVSJ5rgGC%2FtjtlRJv0yvbXkus%2FA5CAcLNMu3Ezu2hD8wY8FT%2BsgxS%2B2mBO4hxfLv3gzl3MMyewlDqyXw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3783903017a-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/css/byw/byw2.css
200 OK 14 kB URL GET HTTP/1.1 174.138.31.128/assets/css/byw/byw2.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
Hash 583af305f716edce4bf7173c15cd5f1b
475b6a1439630b30d05b975cf516c18ead895e27
269b1a653ba29e014b87485082b96bf67d70c7a07c7af25d2497ae04fb71221c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/css/byw/byw2.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 08:10:18 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"650bfa6a-18308"
expires: Tue, 02 Jan 2024 12:49:59 GMT
cache-control: public, max-age=2592000, no-transform
age: 39513
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m8vYgY%2F5YgcEedZo%2BOFjaqsy5UPwhJiiORtLCEt7arc9EW52OHLqb2LshM26TKfNAom9A8FgujOlYa%2F0zlK0NOr6uqSCKPfJHVW3OqP4ERQUZ8FVZH4E815SXWebZDjRhA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3780d2b604e-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/css/additional.css
200 OK 1.9 kB URL GET HTTP/1.1 174.138.31.128/assets/css/additional.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (7696)
Hash 2ff4a977a650b76a8641166f92a7507d
3b3e18ea7c29a8acdbdfc3c5b444456f781021e9
2b735a9ab21e15a9f70552ac4d1f479b4df7bf5161a07c1bbee610e00798c3f4
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/css/additional.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 08:08:23 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"650bf9f7-299f"
expires: Tue, 02 Jan 2024 13:39:33 GMT
cache-control: public, max-age=2592000, no-transform
age: 36539
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sgoaXbBfJ987UwVqr8vTOawV27L%2BY%2FxIuiHuiFcj247RLPkexZEctQj8YtDhtRD%2BOpMtVPSQd01UPPlkY63Yfccgnnnu6%2FOSi6mbmTu29IfXh%2B%2BJW5vxzFcWDkFKaFq4lQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37939b3879d-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/js/vbulletin_md5.js
200 OK 2.0 kB URL GET HTTP/1.1 174.138.31.128/js/vbulletin_md5.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (2780)
Hash 1a28d5e018df6a763d8c43e320c82944
718f3148bc0ebed7f32bf13cbd9766b098488fb5
94a03d94ea079e4a5877a8d14914288246f30a12b3833c8d59ad22dffc63a7d1
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /js/vbulletin_md5.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:38 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f466-1639"
expires: Fri, 08 Dec 2023 00:00:25 GMT
cache-control: public, max-age=2592000, no-transform
age: 2245687
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mu0%2BS4XqRBP2yQv12io5LEE0xjOollp4dc6YCfGQPZAZQLDZAh26EgujKY0F9%2F5SaUOrXhfLTLGyyCeqpKDs96QCOIJglqOtFVPpw5O5oXpEv%2FfrOHgwcuJbGV6KQaO4sw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3795ec35f4b-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/modernizr-2.6.2-respond-1.1.0.min.js
200 OK 7.6 kB URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/modernizr-2.6.2-respond-1.1.0.min.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type HTML document, ASCII text, with very long lines (18450), with no line terminators
Hash 2015fe4e8911558500fb094aac79383b
2d1e5126c8e3386153082b98e841d7a03435d975
bf2d2ce2803063fd72be8165d5fbbc700e24dfd6bfcb351f064367a90db9ef4e
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/modernizr-2.6.2-respond-1.1.0.min.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:06:16 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f5b8-4812"
expires: Thu, 14 Dec 2023 03:37:44 GMT
cache-control: public, max-age=2592000, no-transform
age: 1714248
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GtXs%2FdwGKvfOepy3JZ5SWKZyuvjjd5JxzIsg1HdKtRZJvmkjFfua1vwWcmfOsHp%2FowBeSsHl8hUo%2Fxj1PgHpKT8c6aoQy4cQ4687GSJ5jUuHDOrwXm9%2FwARIfS3xqEBOjg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3797d344923-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/bootstrap/bootstrap.min.js
200 OK 8.4 kB URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/bootstrap/bootstrap.min.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (31650), with no line terminators
Hash d08775b7d337d5f37e3fb102f1a8a913
6cbd6f79def44d7e96d933a17967cd2afcf9ba3c
8ae9a41def07afb4166b08e3143071437d1867e5f26e6bd907899a8b50bbafbb
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/bootstrap/bootstrap.min.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-7ba2"
expires: Tue, 02 Jan 2024 12:49:59 GMT
cache-control: public, max-age=2592000, no-transform
age: 39514
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JJDg60VpUnw9PhL9C3uNQHY9ggPCL31tvyAoapfqf94i2pMxRFZCa%2BP0q7LVggo8VRUP9mu32fPecoAex4Cb2JV0tAnElnyHHJNDqAG6Daf0342hLefSMtkaOuLgqZHT%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37a998e5f9c-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/skrollr/skrollr.min.js
200 OK 5.4 kB URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/skrollr/skrollr.min.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (12360), with no line terminators
Hash 7d6ae9201bf4c1d83ebcacc6da3ec09b
65b20f0c1dba10c7ba3d644fba7ae80ae08d4ced
911dccc7a59863b46d628fdac57d96a7cbf72325fe2555d2a3d165c6258d3464
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/skrollr/skrollr.min.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-3048"
expires: Tue, 02 Jan 2024 23:48:33 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FACCmgIG4%2BFXQifb8WYTMykqURnEmme0%2BhkoZK%2BoCTeehZ6tGcDcuK4DfQt6ND1LodrgdGRlHM9EvJjbmyKFOJdSteB6t0IBDboyI%2FTxrKIRAr7Pfd28Xx%2BsDT%2BCwcVSNw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37a8e5389a4-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/css/vendor/bootstrap/bootstrap.min.css
200 OK 18 kB URL GET HTTP/1.1 174.138.31.128/assets/css/vendor/bootstrap/bootstrap.min.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Hash 9be7e92c9d3c0d15e957a9ba50011c73
43d16973b90a33413b7d13c924edeca9b2a086c5
5e720bd6a28f46376baf874444d00ba888a962c54434f2541bd54a7a27a95eb0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/css/vendor/bootstrap/bootstrap.min.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:31 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 08:08:26 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"650bf9fa-1aaea"
expires: Tue, 02 Jan 2024 13:39:33 GMT
cache-control: public, max-age=2592000, no-transform
age: 36538
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NgOR2YHEjCKLGN3lNoB66WFAzcxfmVY3UweRK14MPKYWlILRhOvrCULs86HV5lqHi48sDb0zqhDP3PAQdT0AETbbgcvJCfZs310nG6CNmX6K7joQDpAluCiWnSIqaKtaBg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37198f24d51-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/text-rotator/jquery.simple-text-rotator.js
200 OK 783 B URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/text-rotator/jquery.simple-text-rotator.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (377)
Hash 9964685a5509aabd8ab04dc6257d97f5
927c58db28fb33c328a5a0bab4f9e3a93555f651
95df7f4d192968c5c68e43a936016ad025fac7ce02a221a1bf13be6592667c30
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/text-rotator/jquery.simple-text-rotator.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 03:57:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f3b1-df0"
expires: Sun, 31 Dec 2023 16:21:31 GMT
cache-control: public, max-age=2592000, no-transform
age: 199622
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dyH%2BsFZCskgp9ba%2F8ZxyXhWxQL48RiG8266L0rE8nFlTYNInSNiQwm9JJpO36QwVb72YBeLBwXUAUXulCbMoMSLDJPLQ0DkSkXvdOSOAI13%2BN6853kLRY7%2BtrCEgdLf84g%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37aa81f603b-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/jquery-2.2.4.min.js
200 OK 30 kB URL GET HTTP/1.1 174.138.31.128/assets/js/jquery-2.2.4.min.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (32065)
Hash b354cc9d56a1da6b0c77604d1b153850
a3d8479f4d4e39b131bc9a53bbf53d1fbaa23732
fdce77a6d0053f32d231518a84a71bcab5c86045ed52369da00b89d4284aef46
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/jquery-2.2.4.min.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:32 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-14e49"
expires: Thu, 14 Dec 2023 12:36:35 GMT
cache-control: public, max-age=2592000, no-transform
age: 1681917
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i5yVJYDnZFj4xgqB5BlPb%2FUR3s4c0jFm6%2Ftd15R7ubfjQd2NPQtpNh4k48xGFe1C3dhWVYjy8CXDvPelUIW3Y1PUDH3Cw%2FXBYaUblnzAWoJ0%2BQ9U5j519IJt9MuSTlt2NQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37878ccab5c-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/owl-carousel/owl.carousel.min.js
200 OK 6.7 kB URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/owl-carousel/owl.carousel.min.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (14916), with no line terminators
Hash 2fec2de7cc7d2d9a66130311f52b5db8
5cfc389925bd8200ee1e0fb224434ded9cae3f15
4b18105a346260a3e8359cd02633fd5f8bb244f2d5f43e4375a1efd10e5c865a
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/owl-carousel/owl.carousel.min.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-3a44"
expires: Tue, 02 Jan 2024 23:48:33 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9sXzO5lsrC5wcFsrUHh9W30oQNOYfX%2FkEfKRfV7HU0vHhnz7R7ZXDFOrlk6FG7pXHe6wixcPuqBW3JJmFpcrv8YmgC%2FJVuyyhpYQfmzQ%2B4qP%2BHJ0s3A%2FwUPpAwnchhRvDw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37adbd0a023-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
iili.io/JqXOiWN.jpg
200 OK 146 kB IP
Certificate IssuerLet's Encrypt
Subjectiili.io
FingerprintAE:84:80:B6:C0:17:87:BE:88:A5:59:04:5D:9F:99:A3:AD:75:1C:A0
ValiditySun, 08 Oct 2023 14:56:20 GMT - Sat, 06 Jan 2024 14:56:19 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 840x480, components 3\012- data
Size 146 kB (145467 bytes)
Hash 0d42ca4b4d08087c9241f778f940a1ec
11ff88e721560628c0011351cf6329ce5ef293a7
04984b0eeb351449c7b661e1fe321ea2842e11e31b7707432fa7121a81e12f9d
GET /JqXOiWN.jpg HTTP/1.1
Host: iili.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 23:48:33 GMT
content-type: image/jpeg
content-length: 145467
last-modified: Sun, 05 Nov 2023 04:07:35 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
cf-cache-status: HIT
age: 5837
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ezW2SKTHbLD1o2CSLyDvxHXSZf6AEtg0lLIliIyKAoS274gJvxltXCh8ohDlefQ%2FePjm0r7W23LiV%2BVcX7KrA1oyTugIf2PfRfPGdD%2FwcHZorDxcQCopOe7t"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ffb37c0efa70f7-HEL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
iili.io/JqXrcFV.jpg
200 OK 116 kB IP
Certificate IssuerLet's Encrypt
Subjectiili.io
FingerprintAE:84:80:B6:C0:17:87:BE:88:A5:59:04:5D:9F:99:A3:AD:75:1C:A0
ValiditySun, 08 Oct 2023 14:56:20 GMT - Sat, 06 Jan 2024 14:56:19 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 840x480, components 3\012- data
Size 116 kB (115635 bytes)
Hash 9caba3d2bfa05c8f99a921b7b599a8c2
8e3d6d8535bda49b9762fd87a02fe4197b0e9a73
6839cb284be33aec94bbb3aaade9733a0b4bf49aefd885f4164dd8cb384413ef
GET /JqXrcFV.jpg HTTP/1.1
Host: iili.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 23:48:33 GMT
content-type: image/jpeg
content-length: 115635
last-modified: Sun, 05 Nov 2023 04:25:32 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
cf-cache-status: HIT
age: 925063
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x7%2BPr2tL%2BP%2BI%2FsPWjTh0Uf4jNSCerAqwu7Cvfh7wi0YvgXY6QqHTqLwCz4Br9XKaG4qMIaKbVtcaLlNnePruSODC1z73u4wz1YnWDso2lKfwwsqNrS9xhZ9R"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ffb37c1f0a70f7-HEL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
iili.io/JqfvPBp.jpg
200 OK 117 kB IP
Certificate IssuerLet's Encrypt
Subjectiili.io
FingerprintAE:84:80:B6:C0:17:87:BE:88:A5:59:04:5D:9F:99:A3:AD:75:1C:A0
ValiditySun, 08 Oct 2023 14:56:20 GMT - Sat, 06 Jan 2024 14:56:19 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 840x480, components 3\012- data
Size 117 kB (117285 bytes)
Hash 45b08cd4821e7b5e93b814ad0b5499df
a153f096babc3d0363826cb7e3576bd7d6de60a8
d8726ec08431eae898db4fd76c075f54dface67b721ae9bbfbc0b198b9526fef
GET /JqfvPBp.jpg HTTP/1.1
Host: iili.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 23:48:33 GMT
content-type: image/jpeg
content-length: 117285
last-modified: Fri, 03 Nov 2023 10:10:08 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
cf-cache-status: HIT
age: 936829
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hjfBp1tKxa0tiS%2BKauhXVbUjL9nRi96HfOYEQud2ohAgoCL3OZn9dhO%2BvbeOwFR2edcXnsPftce%2FEV8%2Bu0JhJwF2831IMHiWcDa7hbGy4kCaAqztN8eO%2BOex"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ffb37c1f1070f7-HEL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
174.138.31.128/assets/js/vendor/nivo-lightbox/nivo-lightbox.min.js
200 OK 2.1 kB URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/nivo-lightbox/nivo-lightbox.min.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (7420), with no line terminators
Hash a5896459ad6790d1d94eb2180e59e965
e5d4b0ef3a929aa6e20ede86b024264a8cf2b473
65723a3f6bf46e95bd82bbbc3f986c0df44ad1b4427abbc3fa252a53ff40b4ea
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/nivo-lightbox/nivo-lightbox.min.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-1cfc"
expires: Tue, 02 Jan 2024 23:48:33 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4zYbJ8w%2FOEo354A7tG8d1a%2F8y3ZnBjkxgw5lZPkXyS1YaKZkxMnIlKjEw%2BcAnG02f0xvWV%2BVmpvafNQ3kJU1Ksqoi59ps9F6Gh6iiXqLLqdVzxkxOZnIYMasw4PPAF8Lig%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37be8e089a1-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/tweet-js/jquery.tweet.min.js
200 OK 3.1 kB URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/tweet-js/jquery.tweet.min.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type HTML document, Unicode text, UTF-8 text, with very long lines (8199), with no line terminators
Hash e6d5a5f7a0d7af2a2c63b97919cac65a
1f61ee273e334ebd7388e219157bf8654482f009
431cff4d223f3296f7d4b543573271745a91d9069a3666844fb3b037aad844c7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/tweet-js/jquery.tweet.min.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-2011"
expires: Sun, 10 Dec 2023 00:13:21 GMT
cache-control: public, max-age=2592000, no-transform
age: 2072112
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1e%2FRcUAq3QmsiuDKhfXMLhSJ4crku5cYvr34DrfHY6rsknG9a%2Bzl08zhLYpnGhWhOfqXp8aQsRs4AyW9GjJ598MrkibxLH0Y2rgtZ2MXSNBxslnzhATAaoBzKLAB%2BRjSBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37bdeac3fc5-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/parallax/jquery.parallax-1.1.3.js
200 OK 434 B URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/parallax/jquery.parallax-1.1.3.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (420)
Hash 1508097fb2657eab7e68bd385cfbdbb1
c65b4cb7750055e01101a4edb2f7d2d749e85174
ba75543913b3258b7a19cdea608c7cc47322898d244b40b6190c970be2d3a2fd
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/parallax/jquery.parallax-1.1.3.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:06:16 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f5b8-3ad"
expires: Tue, 02 Jan 2024 14:59:28 GMT
cache-control: public, max-age=2592000, no-transform
age: 31745
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FiNPgPXmosBdUIchEr4K8bEV%2B6hE%2BSmgStNbtO9vz8564lq50OA0myuK1j22EVQ2MGlV40rN1BTVhh6A1Ld6Ez9zo6mGaLBzBDMWX4cmgLjWL1XhfAUpSuXeYJ8PNu%2B96Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37c0d129f80-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/appear/jquery.appear.js
200 OK 677 B URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/appear/jquery.appear.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (752)
Hash 5fbd164d0b2001df2ba85327fc6bab39
13e083d8852729d2e6cfa3fbcf3955a28275fd00
5d19547b40e94ab90e831bec03fc23d4b894894bb93006b3b3fd8d62e2f355ca
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/appear/jquery.appear.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-610"
expires: Mon, 01 Jan 2024 13:37:08 GMT
cache-control: public, max-age=2592000, no-transform
age: 123085
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UJoJ%2BHjSh1LfRaDXQkueS7GJyqOkMLyJMrlXJmiLmu%2FcxsY1t9%2F3hB5bXVypntj9EshSUuyhaeKz9xTS3Nw6RmEFB0iRfTXnTCFfXpuze9eWU2Me9evG4PQYKYti%2FjmOQw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37bfc934104-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
cdn.livechatinc.com/tracking.js
200 OK 27 kB URL GET HTTP/2 cdn.livechatinc.com/tracking.js
IP
ASN #20940 Akamai International B.V.
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
Hash 040dea15dd9a6c28ae756160d224485f
46597206913ee680550f692bc2ce007ee878c634
3a9092e7843cd485aade33f386466a452095937fc31543f73b24b1c93b4f49b1
GET /tracking.js HTTP/1.1
Host: cdn.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Fri, 01 Dec 2023 09:12:25 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: 3CyuQk8hK5meZFX8yufVSUsdG9OUQ4w7
server: AmazonS3
content-encoding: br
etag: W/"040dea15dd9a6c28ae756160d224485f"
vary: Accept-Encoding
x-amz-cf-pop: ARN56-P2
x-amz-cf-id: rqRowR-Ir0kuI84YXaVlGGEKc-x8g_JsE1jimPJJDsitFK5bGszRKQ==
content-length: 27131
cache-control: max-age=28800
expires: Mon, 04 Dec 2023 07:48:33 GMT
date: Sun, 03 Dec 2023 23:48:33 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
X-Firefox-Spdy: h2
174.138.31.128/assets/js/vendor/jflickrfeed/jflickrfeed.min.js
200 OK 650 B URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/jflickrfeed/jflickrfeed.min.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (425)
Hash 847c6b884e569004695666dd6e90fd0d
0f83977484c914c85ba813adb9c46506baf4a83a
796951855984fed308feec350d31ea2ac1382b2c6aec06412f9c33e1c13fe075
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/jflickrfeed/jflickrfeed.min.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 03:57:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f3b1-5b6"
expires: Sat, 30 Dec 2023 04:17:00 GMT
cache-control: public, max-age=2592000, no-transform
age: 329493
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QYY1Ak8czGkS%2FRTDbcXXNClkEkIIPfyZI7UUHrSqNE8mtTEelFZDgsw2ejqBA5AkD%2BAcWRzTfVZHrH1vwRsJobhbr70GhKjhzH7%2BY2uELvnrF7ZbPVbPgE%2Bo5LaS82GZrg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37c0cf03f87-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/vendor/liScroller/jquery.li-scroller.1.0.js
200 OK 436 B URL GET HTTP/1.1 174.138.31.128/assets/js/vendor/liScroller/jquery.li-scroller.1.0.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (565)
Hash 097d12ca6affd5151d1d56db876cc1e0
4f1b6d162e327a5e8d0f37897d4d559dbc265ba7
e00749ed99da6de8ee85c1fa969a7571feaba5a506c1dd88be8a12e20ed680d9
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/vendor/liScroller/jquery.li-scroller.1.0.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-3ea"
expires: Tue, 02 Jan 2024 23:48:33 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aKngAoHqpaAU1fTwutvHmA6NtSfBos1QMCadRHlBRYo%2BHGsm1MSDpmOI1Vu9nKs4E8J2CfCNkEpSY99Qh9Ove9FhAXqRPxhBJY6g23DF4jVlzhLH%2FWAaUGYHo4iKOS78Ag%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37c3c7f3e59-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
i.ibb.co/BKN8hxv/wa.gif
200 OK 111 kB IP
Certificate IssuerLet's Encrypt
Subjectibb.co
FingerprintCC:72:96:95:90:7F:15:8E:AC:C5:40:3A:D2:6F:83:A3:DF:5E:72:56
ValidityMon, 09 Oct 2023 14:39:49 GMT - Sun, 07 Jan 2024 14:39:48 GMT
File type GIF image data, version 89a, 300 x 300\012- data
Size 111 kB (110794 bytes)
Hash ebe19b02ff9830772fa93092e3b5cf17
4693cea0b2c2e0e3fb02ccf023a3f652c4d58421
17171e198c3a2f8d41bc815334178f376a0d0de8526794445333af9bb3198349
GET /BKN8hxv/wa.gif HTTP/1.1
Host: i.ibb.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 03 Dec 2023 23:48:33 GMT
content-type: image/gif
content-length: 110794
last-modified: Mon, 09 Oct 2023 18:33:17 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
i.ibb.co/vxSKtH7/WISATATOTOQRIS.jpg
200 OK 108 kB URL GET HTTP/2 i.ibb.co/vxSKtH7/WISATATOTOQRIS.jpg
IP
Certificate IssuerLet's Encrypt
Subjectibb.co
FingerprintCC:72:96:95:90:7F:15:8E:AC:C5:40:3A:D2:6F:83:A3:DF:5E:72:56
ValidityMon, 09 Oct 2023 14:39:49 GMT - Sun, 07 Jan 2024 14:39:48 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], progressive, precision 8, 640x366, components 3\012- data
Size 108 kB (108253 bytes)
Hash 322041d7d84b94c2d6b6019d74d28677
017be75800663a2d045b12e68f55ab7eb13b1311
197ea84bc2de9dfccd7c224301568ae81b0dcaf3d33bce4af94e0f7ef177298c
GET /vxSKtH7/WISATATOTOQRIS.jpg HTTP/1.1
Host: i.ibb.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 03 Dec 2023 23:48:33 GMT
content-type: image/jpeg
content-length: 108253
last-modified: Sat, 26 Aug 2023 16:04:35 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2
174.138.31.128/assets/js/style.js?v=1.0
200 OK 2.1 kB URL GET HTTP/1.1 174.138.31.128/assets/js/style.js?v=1.0
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type HTML document, ASCII text, with very long lines (1126)
Hash 6174734545f4d0a24a22ae2f24526eaa
969abdca32818ce8437a095b6c1e478d2bf70345
d943adf3ed1dad80fb33a3380e56e5a584293f8d1694dbb6d5c5d1c6036ee406
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/style.js?v=1.0 HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-16de"
expires: Tue, 02 Jan 2024 23:48:33 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7vJ50Ic3DnKohFKvkDXyIkvpbX5DjROk2tIRS%2F2c30%2BnVluMgS8lI1DIGtAdzQnqFQGMbggKNXFMojrs3nE4h7JdY9EV%2BbSy6gFurAzeL4ztJuAfgQNFw6FGVb8EN3GKDA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37d4fca48fa-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/jquery.fixedheadertable.min.js
200 OK 3.2 kB URL GET HTTP/1.1 174.138.31.128/assets/js/jquery.fixedheadertable.min.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type HTML document, ASCII text, with very long lines (10207)
Hash 406edd97a8850446d2693ef306af0708
bd4996afdab1f18893ef89c3281c55e6585f334e
991994866beb5e90d2205f4c5d4a757ddd38c6399386335991b260a89d857fa1
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/jquery.fixedheadertable.min.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:06:16 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f5b8-298b"
expires: Tue, 02 Jan 2024 19:54:40 GMT
cache-control: public, max-age=2592000, no-transform
age: 14033
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TeiLb%2BLYC4k4cs4e9HMUkbBRcZU2bnZnx1F%2F8dx%2FwDXZsjhjQOILgT3xyTBHUC2SAVcgYKSBfVgMDsPbtGaMC98Hnh8zUDPJylsOWegLh3x2tD2WG6rdbd%2FFuok%2B8Fi%2B3w%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37d3ef43fa7-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/js/jquery.cycle2.min.js
200 OK 6.8 kB URL GET HTTP/1.1 174.138.31.128/assets/js/jquery.cycle2.min.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (22288), with no line terminators
Hash 3981c014980610a347911b3eb292b722
a19a589bbf0d0a607557cc93768fa68ec4d9b87e
6b41e47a54aefc08aaa3678ed56f5689ddf69b8e8a48e9af8acc200ed0559fec
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/jquery.cycle2.min.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 03:57:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f3b1-5710"
expires: Tue, 02 Jan 2024 14:34:53 GMT
cache-control: public, max-age=2592000, no-transform
age: 33220
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9JuuqaYz2EiBzgXbQtjTdOYQsb7Px3gqv7dHrVFCR5RSq%2B8nPRiNzcCHRMt6oyNHGDf1w7i2Tf26aXzP1JMF8LIuARXybUI9vAeo9RFSR%2F9wfjTYSAFfuuvAz8NDiZINow%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37d5b1d455f-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/js/auth/login.js
200 OK 10 kB URL GET HTTP/1.1 174.138.31.128/js/auth/login.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (32510), with no line terminators
Hash 14aad41770fc8d48a42724ca285c51a3
cbdbd04ce8723de32b16fa546782bc543cf580e1
c01d424ad0a1b44e9f5aedd5e3c0e2a6e99e8aea399458fd64ee5c284ef15dd2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /js/auth/login.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 30 Jun 2023 04:02:36 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"649e53dc-7efe"
expires: Sat, 09 Dec 2023 23:12:17 GMT
cache-control: public, max-age=2592000, no-transform
age: 2075776
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xw%2F91yFX5o%2BLtv9jYlz%2BzEv2yQVSGgniQx%2BSFGjlgZZPMN5rv6aaLk%2B7NpZoyJKj%2FqI4XgqaKp6liwMuy7M6UQDXuAr3oGlZ3%2F45BCSU2OgVzIPMB7vbDyq2rr7VxQhHkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37d4d6d4104-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/img/loader.gif
200 OK 5.5 kB URL GET HTTP/1.1 174.138.31.128/assets/img/loader.gif
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type GIF image data, version 89a, 15 x 15\012- data
Hash bc1bcccc4a3342d2063088deae7d17a3
a1a988f912d3e17a908945750b91b508672ccac1
a76090f2d604a7e9bd429900001b367ae94f52d749fd0f94706be887d87cce7f
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/loader.gif HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/assets/css/byw/byw2.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: image/gif
Content-Length: 5517
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:57 GMT
etag: "650bd9c1-158d"
expires: Tue, 02 Jan 2024 19:54:41 GMT
cache-control: public, max-age=2592000, no-transform
age: 14032
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GPibPtYxrBPLhcP3WeVl16rDuG59aJlVUaMrTIyBIr5bvJ9LZc9f0LiMNc6pZ169D8cgNWR8%2FdFiGrCmIRf5jdkVgXR1bAzjoECnpcH7dFrUSThy110hPi6DcYDClC3CAA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37d98bc6594-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/feedback2.png
200 OK 1.2 kB URL GET HTTP/1.1 174.138.31.128/assets/img/feedback2.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 206 x 32, 8-bit colormap, non-interlaced\012- data
Hash 76fa4b2588a14d5e8c62f70f7263d62d
8f2510f7d96cf7a1756ff8dbcafc248bcafb31e1
639775068932c1b628a731e51f57a420b6006929bf08058d1dd628b2b0aa1e51
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/feedback2.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: image/png
Content-Length: 1180
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:51 GMT
etag: "650bd9bb-49c"
expires: Mon, 01 Jan 2024 04:22:28 GMT
cache-control: public, max-age=2592000, no-transform
age: 156365
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XhgFtdAhTl5OLOaQzWpDveBYYEPiVYN99JKhej80kDSL61WEqiYvpqpUDREp12WXM4BgiV6fiJmB2igl1zExVcwSYB2ZTxCttHUTYoY%2FkU5VaZlz4TkgOkUuedQ380Am9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37d8bcc406d-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/wlb2c/icons/numbers/dt/dragon.png
200 OK 9.0 kB URL GET HTTP/1.1 174.138.31.128/assets/img/wlb2c/icons/numbers/dt/dragon.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 500 x 500, 4-bit colormap, non-interlaced\012- data
Hash 7234dff7e392a061cd7b803ec9f17c17
86e92366f6f49ea09920b5d71b57092bf0ccdbfe
119d96453aceb107180da0d71272f3a1e15771e4e2a19ceeffb94b3a541e1001
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/wlb2c/icons/numbers/dt/dragon.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: image/png
Content-Length: 8988
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:58 GMT
etag: "650bd9c2-231c"
expires: Fri, 29 Dec 2023 06:11:49 GMT
cache-control: public, max-age=2592000, no-transform
age: 409004
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=poiEtsnqCUVwCQ93pxEw11%2Fv9IQZ35p%2FcDwRzJ%2FAY%2BTKHylJwzukpYsuvkbD36%2BvjNHF6E8OjboiDiabFtw6IQnjrq4ktA%2F2%2FPnSxone1IIVVIr8CLAX8qZXoFarKDzv%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37eac23460d-SIN
alt-svc: h3=":443"; ma=86400
fonts.gstatic.com/s/roboto/v15/Xyjz-jNkfiYuJf8UC3Lizw.woff
200 OK 27 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v15/Xyjz-jNkfiYuJf8UC3Lizw.woff
IP
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format, TrueType, length 26588, version 1.1\012- data
Hash a84d4b00b169826c4aea77a8611b1e56
aeaff41dcc5caac07876a3931c86456aefdbd54c
37e9d63421fa7b235c859737c6c65ee2ed95d79e7c49be0fe15903de908c2204
GET /s/roboto/v15/Xyjz-jNkfiYuJf8UC3Lizw.woff HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://174.138.31.128
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 26588
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 29 Nov 2023 21:06:38 GMT
expires: Thu, 28 Nov 2024 21:06:38 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 14 Jan 2015 22:47:27 GMT
content-type: font/woff
age: 355315
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
174.138.31.128/images/nomor/og/ogic.png
200 OK 5.5 kB URL GET HTTP/1.1 174.138.31.128/images/nomor/og/ogic.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 120 x 20, 8-bit/color RGBA, non-interlaced\012- data
Hash 4aae6438a3a1ca9b73af64993f0aa4a9
c0e0f3486e884c165418a4b22410017b65098fa1
4efe8b026fe4c3f8ac81f9e4e649a10c58231a0a6229616883a7b5e4ea236a88
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /images/nomor/og/ogic.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/assets/css/game_compressed_ic.min.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: image/png
Content-Length: 5493
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:38 GMT
etag: "6466f466-1575"
expires: Fri, 29 Dec 2023 03:14:27 GMT
cache-control: public, max-age=2592000, no-transform
age: 419646
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iSXB7DwHt426ayfHewTEMWOzfomroPS56WKH7bg0%2FbHtAwbTz6UgTCIGFgNKwoqFE%2FjsbR0zptYfw%2B890LZl8xDknm36jGSpb7EuuqbVD%2F0RjVHGFbc6zfVNb9YuIIJwbw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37f08114486-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/game_compressed_ic/24d.png
200 OK 2.6 kB URL GET HTTP/1.1 174.138.31.128/assets/img/game_compressed_ic/24d.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 500 x 20, 8-bit colormap, non-interlaced\012- data
Hash 06ae9ff422aa941a55101ec1fc9121c7
ecf081cc9e71454ccdd56d3952dda5b244177ec0
9bc853d7d7e94ffe2dff1aa2a7e27b44845689f1001135ccd8e292c347377a6c
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/game_compressed_ic/24d.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/assets/css/game_compressed_ic.min.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: image/png
Content-Length: 2641
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:53 GMT
etag: "650bd9bd-a51"
expires: Thu, 07 Dec 2023 21:40:17 GMT
cache-control: public, max-age=2592000, no-transform
age: 2254096
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OygkdctKVj%2FnmAXvm5OlB3rlcyjJIZ303WfEnP6PT2yn8amTK04WvX82ScEnU0wmqQ1aC3Qjmt3oG2B%2B1CqE6bC1ZJQESwRz8x4UOxP9NtdbTSfk0If09oVZKjF%2BwiUIlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37ee9f801e9-SIN
alt-svc: h3=":443"; ma=86400
fonts.gstatic.com/s/robotoslab/v6/dazS1PrQQuCxC3iOAJFEJYUt79146ZFaIJxILcpzmhI.woff
200 OK 32 kB URL GET HTTP/2 fonts.gstatic.com/s/robotoslab/v6/dazS1PrQQuCxC3iOAJFEJYUt79146ZFaIJxILcpzmhI.woff
IP
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format, TrueType, length 31576, version 1.1\012- data
Hash 031611afee9339d4e1f76795a28aaeca
8be046d89666cb1bc0323f4a22c6d63b62b922cb
2de6a4f3964c03bb35fb9d54b3de00ac38330f5cd91389a3d462269c27775373
GET /s/robotoslab/v6/dazS1PrQQuCxC3iOAJFEJYUt79146ZFaIJxILcpzmhI.woff HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://174.138.31.128
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 31576
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 29 Nov 2023 23:13:22 GMT
expires: Thu, 28 Nov 2024 23:13:22 GMT
cache-control: public, max-age=31536000
age: 347711
last-modified: Thu, 28 Aug 2014 20:40:48 GMT
content-type: font/woff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v15/97uahxiqZRoncBaCEI3aWz8E0i7KZn-EPnyo3HZu7kw.woff
200 OK 27 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v15/97uahxiqZRoncBaCEI3aWz8E0i7KZn-EPnyo3HZu7kw.woff
IP
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format, TrueType, length 26572, version 1.1\012- data
Hash 845280fbf7cf0ca7e186e0b68356ae0b
3e37848e9b9052cdad47a551d55bebd4cef073b6
d729f0522993e04c4463a7ebd01694ad369f6efd78681f270d98afba78aeafaf
GET /s/roboto/v15/97uahxiqZRoncBaCEI3aWz8E0i7KZn-EPnyo3HZu7kw.woff HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://174.138.31.128
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 26572
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 14:53:14 GMT
expires: Fri, 29 Nov 2024 14:53:14 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 14 Jan 2015 22:48:52 GMT
content-type: font/woff
age: 291319
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v15/Pru33qjShpZSmG3z6VYwnT8E0i7KZn-EPnyo3HZu7kw.woff
200 OK 26 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v15/Pru33qjShpZSmG3z6VYwnT8E0i7KZn-EPnyo3HZu7kw.woff
IP
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format, TrueType, length 26528, version 1.1\012- data
Hash b20e0cef1fd0ee15a5fc0d150d4c9672
7bef9051bf8ecdf269228c6e743dad5a8172aea7
47a6d754139b198b90326c9ad8c22bd5e2ba5e2d7e2eeb443deed603255a611a
GET /s/roboto/v15/Pru33qjShpZSmG3z6VYwnT8E0i7KZn-EPnyo3HZu7kw.woff HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://174.138.31.128
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 26528
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 05:00:28 GMT
expires: Fri, 29 Nov 2024 05:00:28 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 14 Jan 2015 22:46:57 GMT
content-type: font/woff
age: 326885
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v15/7m8l7TlFO-S3VkhHuR0at9Ih4imgI8P11RFo6YPCPC0.woff
200 OK 28 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v15/7m8l7TlFO-S3VkhHuR0at9Ih4imgI8P11RFo6YPCPC0.woff
IP
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format, TrueType, length 28548, version 1.1\012- data
Hash 1c2236df616e20bd4894a174fb2d5225
c6e64be68b173f9d89afd3510f6f57d42296d981
dbba47796ddefcfa1570846cfb0787d2871d1db17db1b8ed5c821ceea061b489
GET /s/roboto/v15/7m8l7TlFO-S3VkhHuR0at9Ih4imgI8P11RFo6YPCPC0.woff HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://174.138.31.128
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 28548
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 10:13:08 GMT
expires: Fri, 29 Nov 2024 10:13:08 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 14 Jan 2015 22:48:57 GMT
content-type: font/woff
age: 308125
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
174.138.31.128/assets/img/byw/logo.png?v=123
200 OK 15 kB URL GET HTTP/1.1 174.138.31.128/assets/img/byw/logo.png?v=123
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 210 x 63, 8-bit/color RGBA, non-interlaced\012- data
Hash 8fb46bbccd026a5048d2afe7fe8b4e28
7870c454876aa32faa82baf0c7a5ff8cf632bdd8
aaf648ec5a2625387d08d749653db9b2753d28187633d46d6b76778f589981cb
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/byw/logo.png?v=123 HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/assets/css/byw/byw2.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: image/png
Content-Length: 14749
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:50 GMT
etag: "650bd9ba-399d"
expires: Sun, 31 Dec 2023 08:20:35 GMT
cache-control: public, max-age=2592000, no-transform
age: 228478
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bln6yh6g1rdZH%2BwGuYbuwJ2MZ1nSZKKqbGmxk%2B5t%2FkYiCWvKKr4NjZYglBtxJCSvRmX%2BWOCVgfMDN%2BzqMfuZ1RXidaMPGJ8FTYdO183LIo8YsLG7JH%2BoeNAcNSu03SNEEA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37e89b34092-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/game_compressed_ic/sw.png
200 OK 5.8 kB URL GET HTTP/1.1 174.138.31.128/assets/img/game_compressed_ic/sw.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 860 x 20, 8-bit colormap, non-interlaced\012- data
Hash 5db5dd7dc83315b36658ef2b20d70ecb
eae3d70ba07f94901880709bb900eaa7fd20a166
f2d04939271700bed8781463ddc37c57a65577b3e33795156e40e61f285ad9ac
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/game_compressed_ic/sw.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/assets/css/game_compressed_ic.min.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: image/png
Content-Length: 5823
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:53 GMT
etag: "650bd9bd-16bf"
expires: Sun, 31 Dec 2023 13:24:04 GMT
cache-control: public, max-age=2592000, no-transform
age: 210269
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NEaNJgRH9SjpmvJFWH7h2kBZiVO41AzrmoZkxQPvzlX5EJX99amiWJQlh8%2Fojnl8Tt8pbKCs%2BsDXx92rEdtmhm88P5dK8GFLyB7QC4H6IzUmDGtw6dDYzsj3nyABVF4arQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37f1a523f61-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/images/nomor/pd/dices2.png
200 OK 9.7 kB URL GET HTTP/1.1 174.138.31.128/images/nomor/pd/dices2.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 120 x 41, 8-bit/color RGBA, non-interlaced\012- data
Hash bcf4e47f7b026d145fb8b8af81b249af
e3bb7921fe3a46db34a9e44662f703bf1533b6d1
2b2b1dea4fb7ba051093d8dd1d9de80787e24e0d91a373d9358626181712fe35
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /images/nomor/pd/dices2.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/assets/css/game_compressed_ic.min.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:34 GMT
Content-Type: image/png
Content-Length: 9720
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:06:16 GMT
etag: "6466f5b8-25f8"
expires: Tue, 02 Jan 2024 19:54:41 GMT
cache-control: public, max-age=2592000, no-transform
age: 14033
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bDmgmKf9SoksPCjOOyvPZt2ba6mnWC%2Bao3H8%2F%2Fgg4c5t%2Bkxso8XExj5fkWLuB%2F5sqJyezav9nhrDvFCDLqzxSui35ZRvxo5qQdrj6czJvN1j8H%2FnV%2BuFtEP2kBNTmiJAJw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb380dddf4900-SIN
alt-svc: h3=":443"; ma=86400
depetogelpools.com/wisatatoto/WISATATOTO-BANNER-5.jpg
200 OK 128 kB URL GET HTTP/2 depetogelpools.com/wisatatoto/WISATATOTO-BANNER-5.jpg
IP
Certificate IssuerGoogle Trust Services LLC
Subjectdepetogelpools.com
Fingerprint83:8A:34:08:79:2D:21:A9:F4:5B:5B:F7:E9:13:DA:DF:66:89:39:AD
ValidityTue, 07 Nov 2023 22:08:58 GMT - Mon, 05 Feb 2024 22:08:57 GMT
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 840x480, components 3\012- data
Size 128 kB (128155 bytes)
Hash c85be2076c83e3daf5d2678378157361
ecd8e7052da3c52d1a1da2f4a3f32d22a0590be9
cf27f8189afb5ffe5d3ac8d4ec7d3abfe426790ab635486e714c374ffcc44863
GET /wisatatoto/WISATATOTO-BANNER-5.jpg HTTP/1.1
Host: depetogelpools.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 23:48:33 GMT
content-type: image/jpeg
content-length: 128155
cache-control: public, max-age=604800
expires: Sun, 10 Dec 2023 23:48:33 GMT
last-modified: Sun, 10 Sep 2023 16:53:28 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ArDUEGCxnYL83HRw9e0YNJ6wKe%2FKjXGAKh2Kxhig63AIsckzHulY%2BVQ0RhJe81aXDboZMAl6OKoMJ1zc1eHBZl%2Bygq9cdT8kMeHdQajTHpqCKdcDIZdHv95c%2FrAiyHu41%2BI%2BUxE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ffb37bdb6356c7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
depetogelpools.com/wisatatoto/WISATATOTO-BANNER-2.jpg
200 OK 212 kB URL GET HTTP/2 depetogelpools.com/wisatatoto/WISATATOTO-BANNER-2.jpg
IP
Certificate IssuerGoogle Trust Services LLC
Subjectdepetogelpools.com
Fingerprint83:8A:34:08:79:2D:21:A9:F4:5B:5B:F7:E9:13:DA:DF:66:89:39:AD
ValidityTue, 07 Nov 2023 22:08:58 GMT - Mon, 05 Feb 2024 22:08:57 GMT
File type JPEG image data, progressive, precision 8, 840x480, components 3\012- data
Size 212 kB (212291 bytes)
Hash ee918be424ae8ea5314f34fd5c529167
5345b6ce5e0729fb42b80dd90560af4678bc00d7
cc7ed5f943e9b9668229ddeacd5ab6b3cb325bf1bd845b15b18bc7b28abb5e39
GET /wisatatoto/WISATATOTO-BANNER-2.jpg HTTP/1.1
Host: depetogelpools.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 23:48:34 GMT
content-type: image/jpeg
content-length: 212291
cache-control: public, max-age=604800
expires: Sun, 10 Dec 2023 23:48:33 GMT
last-modified: Sat, 08 Jul 2023 02:27:16 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2qnUQRb1aQipHuYmRRzFs1cRKMrHnFo%2BJq%2BB%2BxUhLc%2FrqowVE9OWaOQgahFgmWusL5j0N4a1OrABMzd9Doecjx9mJN12UMWFjj9%2FJwUpKZCB5Pg5ao1dyl1PZxwZjWg6ha6ST8o%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ffb37bdb6456c7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
depetogelpools.com/wisatatoto/WISATATOTO-BANNER-3.jpg
200 OK 203 kB URL GET HTTP/2 depetogelpools.com/wisatatoto/WISATATOTO-BANNER-3.jpg
IP
Certificate IssuerGoogle Trust Services LLC
Subjectdepetogelpools.com
Fingerprint83:8A:34:08:79:2D:21:A9:F4:5B:5B:F7:E9:13:DA:DF:66:89:39:AD
ValidityTue, 07 Nov 2023 22:08:58 GMT - Mon, 05 Feb 2024 22:08:57 GMT
File type JPEG image data, progressive, precision 8, 840x480, components 3\012- data
Size 203 kB (203367 bytes)
Hash c06494fb9b7006e434b56d0d227b379b
6cb8d76a3fd1cb89c9ca15d0bfbea0ca33faa815
a83d94ac0013f72fcd1eb7a3908de18a688d62518e51a1db2d4c11b6d77b505c
GET /wisatatoto/WISATATOTO-BANNER-3.jpg HTTP/1.1
Host: depetogelpools.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 23:48:34 GMT
content-type: image/jpeg
content-length: 203367
cache-control: public, max-age=604800
expires: Sun, 10 Dec 2023 23:48:33 GMT
last-modified: Sat, 08 Jul 2023 02:27:23 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VneR0ZOJGiZyIllAm0R0A7gv4SROTrWYTKLuBJbF%2BRjWs3D1znbGwLGscqsTaqexTVvxktfHZEGxsE%2F1TLLLD5XiD5IrovHkjcrgo0bEht75dzxdQ%2FP7ZzRgEWEPyPfzpkaFCHs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ffb37beb6d56c7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
174.138.31.128/assets/js/jquery-2.2.4.min.js
200 OK 30 kB URL GET HTTP/1.1 174.138.31.128/assets/js/jquery-2.2.4.min.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (32065)
Hash b354cc9d56a1da6b0c77604d1b153850
a3d8479f4d4e39b131bc9a53bbf53d1fbaa23732
fdce77a6d0053f32d231518a84a71bcab5c86045ed52369da00b89d4284aef46
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/js/jquery-2.2.4.min.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 03:57:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f3b1-14e49"
expires: Sun, 31 Dec 2023 08:37:19 GMT
cache-control: public, max-age=2592000, no-transform
age: 227474
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xyToFf812jVoFZodO8hgElIK%2B%2Bt3LQZjtTJbsIgncI6r0kWSABZ5ZsO8jexCj%2FUp6nJ2hnKJhNPIBq%2BKdSvmlz3atvogJ8hBcoZBYwRWQhdSx1JzuNiEoW71yAyC0izLVA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37ffed140cc-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/fonts/Muli.ttf
200 OK 49 kB URL GET HTTP/1.1 174.138.31.128/assets/fonts/Muli.ttf
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type TrueType Font data, 18 tables, 1st "FFTM", 32 names, Macintosh, Digitized data Copyright (c) 2011-2014, vernon adams.MuliRegularNeWT : Muli : 25-2-2014MuliVersi\012- data
Hash df7330254513d2fa2f4c1e9ee98cc6c6
aa2edf77d86fff82790b846917772837828e4902
45acbaae00fb0cfa8413b582cd4c0dad9653c78a051a7215205079ccc7c7e233
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/fonts/Muli.ttf HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/octet-stream
Content-Length: 49008
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:35 GMT
etag: "6466f463-bf70"
x-cache: MISS
x-cache-hits: 0
Cache-Control: max-age=14400
CF-Cache-Status: EXPIRED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BoGO2vdu778TzvFqkBX0TP9U9hXW8U8O82IddaE1Aik958jzG2GG1StHD27Pe2TZ6bHUZj6tGlzscE4t7sGnAg7rpH0rt83ubBSGY%2FByelVjjzjICHqSc6qRszgeom7GCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb38038545fa3-SIN
alt-svc: h3=":443"; ma=86400
api.livechatinc.com/v3.6/customer/action/get_dynamic_configuration?license_id=15438312&client_id=c5e4f61e1a6c3b1521b541bc5c5a2ac5&url=https%3A%2F%2F174.138.31.128%2F&channel_type=code&jsonp=__gj8kyw7hj3w
200 OK 386 B URL GET HTTP/2 api.livechatinc.com/v3.6/customer/action/get_dynamic_configuration?license_id=15438312&client_id=c5e4f61e1a6c3b1521b541bc5c5a2ac5&url=https%3A%2F%2F174.138.31.128%2F&channel_type=code&jsonp=__gj8kyw7hj3w
IP
ASN #20940 Akamai International B.V.
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (386), with no line terminators
Hash 770213c2d67d00299e03936d16d691f4
942fb87448e3b05b48595242df803a04971c78cb
d65930c991a4e67c4df931ca5b9d4951e5111b0a36dd95c6310f8f0594edbf32
GET /v3.6/customer/action/get_dynamic_configuration?license_id=15438312&client_id=c5e4f61e1a6c3b1521b541bc5c5a2ac5&url=https%3A%2F%2F174.138.31.128%2F&channel_type=code&jsonp=__gj8kyw7hj3w HTTP/1.1
Host: api.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-security-policy: frame-ancestors https://174.138.31.128/;
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-frame-options: allow-from https://174.138.31.128/
content-length: 386
date: Sun, 03 Dec 2023 23:48:34 GMT
X-Firefox-Spdy: h2
174.138.31.128/assets/img/game_compressed_ic/rw.png
200 OK 281 B URL GET HTTP/1.1 174.138.31.128/assets/img/game_compressed_ic/rw.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 60 x 20, 8-bit colormap, non-interlaced\012- data
Hash fdf810d1a4a223c2d32a4f4495ef3878
fe67a1852f7ef7c433c5c1d6b32b7a1dec175578
456f48efa1803acc226bcf86f8b75216dd22171d83295cc6039d228d13672797
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/game_compressed_ic/rw.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/assets/css/game_compressed_ic.min.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:34 GMT
Content-Type: image/png
Content-Length: 281
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:53 GMT
etag: "650bd9bd-119"
expires: Sun, 31 Dec 2023 00:28:16 GMT
cache-control: public, max-age=2592000, no-transform
age: 256818
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZyhQPFTRnbDzD4ej3jnyPdPbSAjcHJzSi5SPT0X1u0oPBrRVc59pQUNu4vNRJHScDOcbRbPu3AKZ1vepZ%2F7CpvYmDd6LviGvnKVc6xlOpnk%2BSvBtZcnSrT4BsuuVcFaLpQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb381fc3b5f4c-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/wlb2c/icons/shio/kuda.svg
200 OK 1.5 kB URL GET HTTP/1.1 174.138.31.128/assets/img/wlb2c/icons/shio/kuda.svg
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 574153ceea1271fd5bdcdd66c61c5c0c
a4133e31b21990ab06c97cd0b19e9cfde964d4fd
110e735f0ef98c470b33c57c3e5fc47c579fbfb5c8f1db76d234ad598c48bfd9
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/wlb2c/icons/shio/kuda.svg HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/css/shio_svg.min.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:34 GMT
Content-Type: image/svg+xml
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
last-modified: Thu, 21 Sep 2023 05:50:57 GMT
etag: W/"650bd9c1-c82"
expires: Tue, 02 Jan 2024 23:48:34 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z0rUoHUdLhcMygH5mbqgqhq9%2FMg3s39AYrIc1XPSjSKiguNUvZAOSmmBaeKHWcrqz%2FzlQGPcw%2Bs7HKp64hy5hDAVdM5mfb2TYcpDwZRv8P%2F2Et2sxKgu1%2F1hw0ovvlIjDQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb382087b602f-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/img/wlb2c/icons/shio/naga.svg
200 OK 2.1 kB URL GET HTTP/1.1 174.138.31.128/assets/img/wlb2c/icons/shio/naga.svg
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash a2b20adf90c45899578c0e2f37d49ef8
7048b5ba3e8b30599f5feb96d91e5d7a0e3806cc
461b85823480abbe94046662b6e4db35c2d5ce17122a0af553effeff2d15a1dc
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/wlb2c/icons/shio/naga.svg HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/css/shio_svg.min.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:34 GMT
Content-Type: image/svg+xml
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
last-modified: Thu, 21 Sep 2023 05:50:57 GMT
etag: W/"650bd9c1-117c"
expires: Tue, 02 Jan 2024 23:48:34 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TJTekQMK%2B9T0rE8NMQP9k0qxWWKKEGMNtxQ8ow5J5JtDWSGjWhoDSoNjAQoNyCPd0mQiyVu3RzK27eYzKSx2XN4RYAjuozbmUABMj48E9f83%2B5F4MU5NkkiugrsAqhdnJA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3829eb744be-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
200 OK 77 kB URL GET HTTP/1.1 174.138.31.128/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 77160, version 4.459\012- data
Hash af7ae505a9eed503f8b8e6982036873e
d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/assets/css/font-awesome.min.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: application/octet-stream
Content-Length: 77160
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:35 GMT
etag: "6466f463-12d68"
x-cache: MISS
x-cache-hits: 0
Cache-Control: max-age=14400
CF-Cache-Status: EXPIRED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gVB%2F0HKupJuuZDStM%2BiRzNz%2FaVH3BWWdRzENEPq9OjTH2Mu%2B3Sdj5x2OgkoJr%2BIMVNybRy87NdIEKFItYlVKw4cPlPm6GBbn9wgDYWgXf7cz6vw54AU5fmPTFhM%2F7ChQQg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb380594f3dc5-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/wlb2c/icons/shio/monyet.svg
200 OK 1.3 kB URL GET HTTP/1.1 174.138.31.128/assets/img/wlb2c/icons/shio/monyet.svg
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 1091f9e630e26f3e270fff9fad830a0b
da6fbce46cf458d3f069e9863da268608c37a1a8
44783e301531e401335349d54db9dad27fedec364eecba910f6ab9d64c503db7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/wlb2c/icons/shio/monyet.svg HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/css/shio_svg.min.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:34 GMT
Content-Type: image/svg+xml
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
last-modified: Thu, 21 Sep 2023 05:50:57 GMT
etag: W/"650bd9c1-949"
expires: Tue, 02 Jan 2024 23:48:34 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a1VmynY%2FW6bmCF8v9dAzmxFacc2r4a2hMXI5mvSbaGnAY0Vj%2B471l%2F%2BPHoiszgAC4En0XM2JiBUs8uocKh9JPbh9B0Cfrt9V6JXyZODn5q4DqUjf3kDGgKEdv9J39%2Bftmg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb382d9ef8959-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
api.livechatinc.com/v3.4/customer/action/get_configuration?organization_id=0859ab0c-966f-4a19-8ee5-858e4d144fe6&version=257.0.1.6.78.123.1.1.1.37.1.4.117&group_id=0&jsonp=__lc_static_config
200 OK 2.1 kB URL GET HTTP/2 api.livechatinc.com/v3.4/customer/action/get_configuration?organization_id=0859ab0c-966f-4a19-8ee5-858e4d144fe6&version=257.0.1.6.78.123.1.1.1.37.1.4.117&group_id=0&jsonp=__lc_static_config
IP
ASN #20940 Akamai International B.V.
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (6013), with no line terminators
Hash 077e764509c7f02cb9c7e45e136d2bc9
94aa667fbbbee7a508e386ce6715c3a0cd710c2b
022fef7b87bd8037042efd47755d91d03c05babe6bbb448387d38f41ab1b3189
GET /v3.4/customer/action/get_configuration?organization_id=0859ab0c-966f-4a19-8ee5-858e4d144fe6&version=257.0.1.6.78.123.1.1.1.37.1.4.117&group_id=0&jsonp=__lc_static_config HTTP/1.1
Host: api.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-encoding: gzip
content-type: application/javascript; charset=UTF-8
legacy: 2024-05-31
vary: Accept-Encoding
cache-control: public, max-age=600
expires: Sun, 03 Dec 2023 23:58:34 GMT
date: Sun, 03 Dec 2023 23:48:34 GMT
content-length: 2135
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v15/Xyjz-jNkfiYuJf8UC3Lizw.woff
200 OK 27 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v15/Xyjz-jNkfiYuJf8UC3Lizw.woff
IP
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format, TrueType, length 26588, version 1.1\012- data
Hash a84d4b00b169826c4aea77a8611b1e56
aeaff41dcc5caac07876a3931c86456aefdbd54c
37e9d63421fa7b235c859737c6c65ee2ed95d79e7c49be0fe15903de908c2204
GET /s/roboto/v15/Xyjz-jNkfiYuJf8UC3Lizw.woff HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://174.138.31.128
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 26588
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 29 Nov 2023 21:06:38 GMT
expires: Thu, 28 Nov 2024 21:06:38 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 14 Jan 2015 22:47:27 GMT
content-type: font/woff
age: 355316
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
fonts.gstatic.com/s/roboto/v15/Pru33qjShpZSmG3z6VYwnT8E0i7KZn-EPnyo3HZu7kw.woff
200 OK 26 kB URL GET HTTP/2 fonts.gstatic.com/s/roboto/v15/Pru33qjShpZSmG3z6VYwnT8E0i7KZn-EPnyo3HZu7kw.woff
IP
Certificate IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintE5:79:1F:1A:04:3F:B9:B0:FB:41:4E:B5:E5:97:AD:FE:D9:2C:4A:CD
ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT
File type Web Open Font Format, TrueType, length 26528, version 1.1\012- data
Hash b20e0cef1fd0ee15a5fc0d150d4c9672
7bef9051bf8ecdf269228c6e743dad5a8172aea7
47a6d754139b198b90326c9ad8c22bd5e2ba5e2d7e2eeb443deed603255a611a
GET /s/roboto/v15/Pru33qjShpZSmG3z6VYwnT8E0i7KZn-EPnyo3HZu7kw.woff HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://174.138.31.128
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 26528
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 05:00:28 GMT
expires: Fri, 29 Nov 2024 05:00:28 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 14 Jan 2015 22:46:57 GMT
content-type: font/woff
age: 326886
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
174.138.31.128/assets/img/game_compressed_ic/12d.png
200 OK 1.8 kB URL GET HTTP/1.1 174.138.31.128/assets/img/game_compressed_ic/12d.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 280 x 20, 8-bit colormap, non-interlaced\012- data
Hash ad8cd441fb879fb7e8046f6c0c8676d4
ce01b9cac80990ffe03a8a8e53fb038630b6680e
ae48dac891fe1310454206cbf46d917df54b8dc2c9924f6e64599de9c9328230
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/game_compressed_ic/12d.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/assets/css/game_compressed_ic.min.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:34 GMT
Content-Type: image/png
Content-Length: 1815
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:53 GMT
etag: "650bd9bd-717"
expires: Sat, 09 Dec 2023 23:22:36 GMT
cache-control: public, max-age=2592000, no-transform
age: 2075158
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e9IdMYkBTuYtq1aELLPX2aw6cuZiR4npYGV2S1dsDyLBDUmAZMLdThg71%2Fp4cbxxjnjxGc86aK3Dzc2%2B9PUzZVSQkQG4KkKf3HTqu8vmAIVCLp2Fjct%2FWzOM8OD2K2mQYg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3836c349e2f-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/js/vbulletin_md5.js
200 OK 2.0 kB URL GET HTTP/1.1 174.138.31.128/js/vbulletin_md5.js
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (2780)
Hash 1a28d5e018df6a763d8c43e320c82944
718f3148bc0ebed7f32bf13cbd9766b098488fb5
94a03d94ea079e4a5877a8d14914288246f30a12b3833c8d59ad22dffc63a7d1
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /js/vbulletin_md5.js HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62; _ga_KZN5DGMJK9=GS1.1.1701647319.1.0.1701647319.0.0.0; _ga=GA1.1.313255608.1701647319
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:34 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:38 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f466-1639"
expires: Sat, 09 Dec 2023 21:48:21 GMT
cache-control: public, max-age=2592000, no-transform
age: 2080813
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F2WmH%2BcDZJjBuARkw4zsV6JdYEnhOl5%2F58M5hU3OHbt0Q4rw91t9w%2FBqo0tod6PSRlFwRH83y2aR8QDJCJ1ILUH3jd8uzHhiXNeug8pJvjnqgKQ9t1M3c2yxv6fgzRDCFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3837b0789b3-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/images/nomor/ht/htic.png
200 OK 1.5 kB URL GET HTTP/1.1 174.138.31.128/images/nomor/ht/htic.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 40 x 20, 8-bit colormap, non-interlaced\012- data
Hash aedda6ef7fd1e787b7f77ad996bd47d1
15d81d48a70f41df0340846408503e96199ff0e6
dd31f66e1eb73b77d24f9140ca36e0070dcc677076688448dcc0b05002fbb18d
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /images/nomor/ht/htic.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/assets/css/game_compressed_ic.min.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:34 GMT
Content-Type: image/png
Content-Length: 1540
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:06:16 GMT
etag: "6466f5b8-604"
expires: Tue, 02 Jan 2024 14:59:45 GMT
cache-control: public, max-age=2592000, no-transform
age: 31729
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2z7IfxOaz60MR9pyO9IxJyLS37nGC6s4rW2%2B3Ijw0ldYR9fV%2BRPr5u8Fo6j2nkijz7LfLXtjH8muhyju9yYl2OI98MkaAr7xp3y0cSFKYP2IbjwpXjjYN1thKVcKt5zjaw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3840bd55f90-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/images/nomor/dicesd.png
200 OK 1.7 kB URL GET HTTP/1.1 174.138.31.128/images/nomor/dicesd.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 90 x 15, 8-bit colormap, non-interlaced\012- data
Hash 836d4850a6eb70dc3ecd48d6b4d0cad4
d0b181430aedfe433213a3e500f0ffb5746c66ce
41649a0f9bbb882403b4228b444cd868cc815eaeddeffd56874dfec6b0a66e2b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /images/nomor/dicesd.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/assets/css/game_compressed_ic.min.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:34 GMT
Content-Type: image/png
Content-Length: 1668
Connection: keep-alive
last-modified: Fri, 19 May 2023 03:57:37 GMT
etag: "6466f3b1-684"
expires: Sat, 30 Dec 2023 15:24:34 GMT
cache-control: public, max-age=2592000, no-transform
age: 289440
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ghuUjMk%2Fe1K8%2FGDkv64vgL0E4t8zXa4cNXzNzU6ZH%2FrpmKP%2BXyx96McifenAmO%2B2OUwJwe5kVUizHTLiLE3yCA7crtQNsd5XmYGau7np9k7PrR9N%2FHBW4rNricpLehukJg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb384389b4000-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/images/nomor/gb/gbpic.png
200 OK 7.8 kB URL GET HTTP/1.1 174.138.31.128/images/nomor/gb/gbpic.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 260 x 20, 8-bit/color RGBA, non-interlaced\012- data
Hash e6bb0ad7230d88d7ab6c73b5f51d9485
612a5afa140d86c5bd7de81b1432f8444c6f5a82
17fab5007232d6eeba86c60bdb778f82cdb0ceb6005dffe1e28e853621f3cebd
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /images/nomor/gb/gbpic.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/assets/css/game_compressed_ic.min.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:34 GMT
Content-Type: image/png
Content-Length: 7755
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:38 GMT
etag: "6466f466-1e4b"
expires: Tue, 02 Jan 2024 23:48:34 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eF4vikOHEsgL4TEHIeWvq4%2BeWxm5WaUR4wTvK%2Fa7MyGIFbI3LcDc%2BmsKGruWYf72ep8jM1C6PAZXeA5pHDqUXd4MNIDihGmm2TtqO6%2BCKU%2B3AoSrLUCpk57vUnS7bOSftQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3842dc63e0d-SIN
alt-svc: h3=":443"; ma=86400
api.livechatinc.com/v3.4/customer/action/get_localization?organization_id=0859ab0c-966f-4a19-8ee5-858e4d144fe6&version=075b79d72a19c7c515c01775c17428ae_b2b48604dd749186acf621715ae23b54&language=id&group_id=0&jsonp=__lc_localization
200 OK 4.3 kB URL GET HTTP/2 api.livechatinc.com/v3.4/customer/action/get_localization?organization_id=0859ab0c-966f-4a19-8ee5-858e4d144fe6&version=075b79d72a19c7c515c01775c17428ae_b2b48604dd749186acf621715ae23b54&language=id&group_id=0&jsonp=__lc_localization
IP
ASN #20940 Akamai International B.V.
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type Unicode text, UTF-8 text, with very long lines (11630), with no line terminators
Hash 56c1822336a3e12a5b3018b13b38bf1a
b1594dc9c420593797e2a7496003fa70d9d5217b
279460ab5973e5957df5abac64804968dbf88b1885fb6393c5602d45b62ea31f
GET /v3.4/customer/action/get_localization?organization_id=0859ab0c-966f-4a19-8ee5-858e4d144fe6&version=075b79d72a19c7c515c01775c17428ae_b2b48604dd749186acf621715ae23b54&language=id&group_id=0&jsonp=__lc_localization HTTP/1.1
Host: api.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-encoding: gzip
content-type: application/javascript; charset=UTF-8
legacy: 2024-05-31
vary: Accept-Encoding
cache-control: public, max-age=600
expires: Sun, 03 Dec 2023 23:58:34 GMT
date: Sun, 03 Dec 2023 23:48:34 GMT
content-length: 4314
X-Firefox-Spdy: h2
secure.livechatinc.com/customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0
200 OK 2.6 kB URL GET HTTP/2 secure.livechatinc.com/customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0
IP
ASN #20940 Akamai International B.V.
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (8911), with no line terminators
Hash 5d5e2818bfde3f97c7c717552a9d4435
d9152624df02dd703ca4b9090b2def298942f080
70f82e173809bbbcd4884d0b853599ec31f03527a47282721d722c69d9de56d3
GET /customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0 HTTP/1.1
Host: secure.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-encoding: gzip
content-type: text/html; charset=utf-8
vary: Accept-Encoding
date: Sun, 03 Dec 2023 23:48:34 GMT
content-length: 2616
X-Firefox-Spdy: h2
174.138.31.128/assets/img/icon/icon-pools.jpg
200 OK 6.9 kB URL GET HTTP/1.1 174.138.31.128/assets/img/icon/icon-pools.jpg
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x205, components 3\012- data
Hash 1b61fe941c5f21b6a5b2a0021304325e
57e917596324667df9bb88ef7aaa181bfd53ae0a
c1af05964be2562a6bbf7c1d8f2a19554198d2e2c1980454a2b8f61f307772ff
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/icon/icon-pools.jpg HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:34 GMT
Content-Type: image/jpeg
Content-Length: 6870
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:51 GMT
etag: "650bd9bb-1ad6"
expires: Tue, 02 Jan 2024 12:49:59 GMT
cache-control: public, max-age=2592000, no-transform
age: 39515
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kk6Mj8GPIJAVkfS0%2FQb1JmVwkT2P4a9y2HzrpHaJpFC%2BMYqizQ4ngF28ecLSYofNP5PJk%2FQf5l62Q06ToeVqKZyRUdV2FKY8V9dUc6%2Bn8qDb4gekgBqGep%2BEJghePOvFrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb384991d462b-SIN
alt-svc: h3=":443"; ma=86400
depetogelpools.com/images/rtpdepe.gif
200 OK 1.0 MB URL GET HTTP/2 depetogelpools.com/images/rtpdepe.gif
IP
Certificate IssuerGoogle Trust Services LLC
Subjectdepetogelpools.com
Fingerprint83:8A:34:08:79:2D:21:A9:F4:5B:5B:F7:E9:13:DA:DF:66:89:39:AD
ValidityTue, 07 Nov 2023 22:08:58 GMT - Mon, 05 Feb 2024 22:08:57 GMT
File type GIF image data, version 89a, 180 x 180\012- data
Size 1.0 MB (1021807 bytes)
Hash 533c9b048685d6d9d54490e1ff5ee098
5fd888e28ac88eabfb0dc80a59d1b9bec8242f82
47dff46b23aeb766614e27473110ff377958840ca664c34c7047344961fa795d
GET /images/rtpdepe.gif HTTP/1.1
Host: depetogelpools.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 23:48:34 GMT
content-type: image/gif
content-length: 1021807
cache-control: public, max-age=604800
expires: Sun, 10 Dec 2023 23:48:33 GMT
last-modified: Mon, 29 May 2023 10:07:18 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bay8XRxR5E%2BiAE0eFsfeZvdZBba2vvMfjEJ1Pe36HNh5i1z7g%2BTanVYONvNreYOjUuwZZ0ZOUa005sZrGrmcg76lB7Y4J64YDFMG2Zmqics6cqaWuIJs2jqjk0wmKRsMEoWhXw0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ffb37beb6a56c7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
174.138.31.128/assets/img/brands/idnplay.webp
200 OK 9.0 kB URL GET HTTP/1.1 174.138.31.128/assets/img/brands/idnplay.webp
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type RIFF (little-endian) data, Web/P image\012- data
Hash d06cc59112bf00c5c4d69f6e49ea5f8f
c90143caf49335590bcbe724ed7ee28d4e74e653
505bee678aaf2026baec6ea3a2e0a492967e6e8e1e979404a4fda80c5e2b367b
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/brands/idnplay.webp HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:33 GMT
Content-Type: image/webp
Content-Length: 9032
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:49 GMT
etag: "650bd9b9-2348"
age: 4203
x-cache: HIT
x-cache-hits: 1
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oS0wc0PjY%2Bv4xoPORv0gNQ1yPS%2BHllLPo5jUXfBDw0sASRLwmx3yzrxLJqbxRiZMrQtWxaNHoVE5dINS2lj1p8dSa8A%2BGgY4808f4Aewl861FGrmvN2jEs2g2ugi7gzNgA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb37e8c2b40da-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/icon/icon-24dspin.jpg
200 OK 5.3 kB URL GET HTTP/1.1 174.138.31.128/assets/img/icon/icon-24dspin.jpg
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x205, components 3\012- data
Hash 97ce6779ea88d190219b696fdd95ad7c
14d912aeee43d9c6cebaac1f3c59ea97f7fd364b
bb33c75ebfea05c8a890cf324caa643447aff6ccc845cf1b6877d9d0ed214a61
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/icon/icon-24dspin.jpg HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:34 GMT
Content-Type: image/jpeg
Content-Length: 5339
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:51 GMT
etag: "650bd9bb-14db"
expires: Mon, 01 Jan 2024 04:18:55 GMT
cache-control: public, max-age=2592000, no-transform
age: 156365
x-cache: HIT
x-cache-hits: 1
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R0yYodtT%2Fzdbi3ghtKIuV%2BrBwurig4kxhnt0jh%2BGjOvlcDZIprpENqeFpVM46LGGLJG9%2F9eDbx%2BAbt2MqbSVGbjdirjoAW9QD4khA2E8YxBLEWCKsouqmIOk8Il%2B3O7xYw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb384fc563d99-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/css/components/loader.css
200 OK 1.0 kB URL GET HTTP/1.1 174.138.31.128/css/components/loader.css
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type ASCII text, with very long lines (2950), with no line terminators
Hash f81874edee808f64a81f1c1994902cbb
3077fa00bc4fe56438a060eefcea27e910563c74
2f75efe3c598d795e95fade1746451bb15e1e950724f34155195d4d6e93180ae
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /css/components/loader.css HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62; _ga_KZN5DGMJK9=GS1.1.1701647319.1.0.1701647319.0.0.0; _ga=GA1.1.313255608.1701647319
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:34 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
last-modified: Fri, 19 May 2023 04:00:37 GMT
Vary: Accept-Encoding, Accept-Encoding
etag: W/"6466f465-b86"
expires: Fri, 29 Dec 2023 02:13:57 GMT
cache-control: public, max-age=2592000, no-transform
age: 423277
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ASrDC3BsTkHITUxGeUROKtISiA0pAwYO9gPtu0mF8xMdHX1NFL3CBF5jCgEgW7RDR1dEcnHQ8Wo7MEZEf0iQtSwJk7jgYt5MAkYKaHRa63QyKrfwuikOWgPnNGKQPZ8%2F9w%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3856c3e3e06-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
cdn.livechatinc.com/widget/static/js/0.560086b6.chunk.js
200 OK 15 kB URL GET HTTP/2 cdn.livechatinc.com/widget/static/js/0.560086b6.chunk.js
IP
ASN #20940 Akamai International B.V.
Requested by https://secure.livechatinc.com/customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (47599), with no line terminators
Hash 1ac03d967e46fcf63e261e02fe3ac706
6ed4f32f5bee5e2aaf28a057ca0a8a83ad404b99
37e38fc2a4947983da3a03b38d58f6a734e61530fd9bcb6dca05bc48ed1f73ca
GET /widget/static/js/0.560086b6.chunk.js HTTP/1.1
Host: cdn.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://secure.livechatinc.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
last-modified: Mon, 31 Jul 2023 10:32:01 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: x4bp2rNlF.2.Kjwsgr0x4zgcAMUxyD_n
server: AmazonS3
content-encoding: br
etag: W/"1ac03d967e46fcf63e261e02fe3ac706"
vary: Accept-Encoding
x-amz-cf-pop: ARN56-P2
x-amz-cf-id: iO68LFTKsE5oAk4sskP39JIOp4J8EIfoiByZsATnWjmW3TwnZVjTpg==
content-length: 14880
cache-control: max-age=31536000
expires: Mon, 02 Dec 2024 23:48:34 GMT
date: Sun, 03 Dec 2023 23:48:34 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
X-Firefox-Spdy: h2
cdn.livechatinc.com/widget/static/js/1.b3e9bd18.chunk.js
200 OK 66 kB URL GET HTTP/2 cdn.livechatinc.com/widget/static/js/1.b3e9bd18.chunk.js
IP
ASN #20940 Akamai International B.V.
Requested by https://secure.livechatinc.com/customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (65462)
Hash a1c381c5236d931e165b5f97bb458c7f
ca2fd79d761e9d7895a9ea92e53f1073930bf50d
c3fa220489a7130866d79f6a79792aa69ce0ce23ea4ba181a03144002736d5ae
GET /widget/static/js/1.b3e9bd18.chunk.js HTTP/1.1
Host: cdn.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://secure.livechatinc.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 23 Nov 2023 10:38:14 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: RWJiCAzhtwX6bpdOAENKLtzWJ..6vb_F
server: AmazonS3
content-encoding: br
etag: W/"a1c381c5236d931e165b5f97bb458c7f"
vary: Accept-Encoding
x-amz-cf-pop: AMS58-P4
x-amz-cf-id: 8HAcOpSlqP2Tm8HGEWooKO3A3UyCcAvtfqlNI-WPJU8I7G3-vMSAVg==
content-length: 66442
cache-control: max-age=31536000
expires: Mon, 02 Dec 2024 23:48:34 GMT
date: Sun, 03 Dec 2023 23:48:34 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
X-Firefox-Spdy: h2
cdn.livechatinc.com/widget/static/js/iframe.bb4ab153.chunk.js
200 OK 222 kB URL GET HTTP/2 cdn.livechatinc.com/widget/static/js/iframe.bb4ab153.chunk.js
IP
ASN #20940 Akamai International B.V.
Requested by https://secure.livechatinc.com/customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (65457)
Size 222 kB (222200 bytes)
Hash 5eea972ba892e91b5afa4c0055c8931a
468657ec85fc8c1637ff5411e8a79528dbded746
7940d8af9045467b193030f86b21ef9949600e11c524a110186cacb3cb84644c
GET /widget/static/js/iframe.bb4ab153.chunk.js HTTP/1.1
Host: cdn.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://secure.livechatinc.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 01 Dec 2023 09:12:28 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: 5YEJ2U9AQDXGnhO4_TkuMnKZpb8ReKEa
server: AmazonS3
content-encoding: br
etag: W/"5eea972ba892e91b5afa4c0055c8931a"
vary: Accept-Encoding
x-amz-cf-pop: ARN56-P2
x-amz-cf-id: 65EMyW2Ma03qnNYs8z4Nlc-EOeKjjQnJrFNQSQrGs1sB1aJ0-gch2w==
content-length: 222200
cache-control: max-age=31536000
expires: Mon, 02 Dec 2024 23:48:34 GMT
date: Sun, 03 Dec 2023 23:48:34 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
X-Firefox-Spdy: h2
174.138.31.128/assets/img/bri.png
200 OK 1.0 kB URL GET HTTP/1.1 174.138.31.128/assets/img/bri.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 85 x 21, 8-bit colormap, non-interlaced\012- data
Hash 6dc0d7a52a5bbb2bbf4fa766d445632a
5f3bf4eeb2065a5ada283143a629b5b6126350e5
5cac9c4ea7470f69937f3e0c66643af243f022ba1d0d1b92ea0b891be8d3e708
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/bri.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: image/png
Content-Length: 1040
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:51 GMT
etag: "650bd9bb-410"
expires: Thu, 28 Dec 2023 03:23:55 GMT
cache-control: public, max-age=2592000, no-transform
age: 505480
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Op3gvO%2BdgkpA9JNtyGBJ5Rnj%2BP%2BMbgzhTWfSH1bn%2BqhSPptwi24L0Kcbjo4GzpJ%2Fa7h%2F0ZYtZH0Wr4GlbVIjS11HeSTiX4FSVoDdYRXBeHt09q9lGgtsUMFC22h4i7HsrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb386ecbf3e4f-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/bca.png
200 OK 1.1 kB URL GET HTTP/1.1 174.138.31.128/assets/img/bca.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 78 x 24, 8-bit colormap, non-interlaced\012- data
Hash 6acd78d945803ba574275cb83b5e4981
e2705a9ac3be32cc594bf8ebe29da30c46cb2013
b60a19eb59f86325af0f4c3e4736e6ed7f3ecc1cadd6efe316e90ae7a75f0ce7
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/bca.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: image/png
Content-Length: 1086
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:48 GMT
etag: "650bd9b8-43e"
expires: Sun, 31 Dec 2023 00:42:43 GMT
cache-control: public, max-age=2592000, no-transform
age: 255952
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9aNtdfdnXxoo6HMc1TNhln7DjMHxiC5E5P5WCRyXGVerlI6M6ROeipqB8ukJ0FwqMzQqz5hP7nZS5gOw54%2BGvt991Sv8wum9asuK4rsqit5CQu4qbe6BU%2BBme5iRSF9LjA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb386edf06beb-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/dana.png
200 OK 2.2 kB URL GET HTTP/1.1 174.138.31.128/assets/img/dana.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 89 x 25, 8-bit/color RGBA, non-interlaced\012- data
Hash d4c86054bef770accb247693dce1184d
215ae0206849177269831f7b9e433794b2ef80ea
eb6f10f5452fd08234a524d21df41a6b9be1466c0c3acd39017951cd4122a3cf
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/dana.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: image/png
Content-Length: 2233
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:53 GMT
etag: "650bd9bd-8b9"
expires: Sat, 30 Dec 2023 02:39:31 GMT
cache-control: public, max-age=2592000, no-transform
age: 335344
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QxuVTOsL2CXoyJZg%2FG0fdrTHWXZ52Cg3pMum8lBF53Nc5BFjV1Db87dTybwP5bzl2lqJEZpg%2FgnDpdc83jTxrR3YBqKzXdimawzFEDiijMrCxOuG0pbO0ao3TyLbT0bjxA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb386fd883dab-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/indicator.png
200 OK 3.0 kB URL GET HTTP/1.1 174.138.31.128/assets/img/indicator.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 18 x 51, 8-bit/color RGBA, non-interlaced\012- data
Hash bbad9d0aef39c55cba161ff5ab3c7d30
f9f2e4b293fd67a108c95d221437240c810d67f4
b7704daabf987a684873b073f895609ac0dead3f8139dbd872434a8c67270e05
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/indicator.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/assets/css/byw/byw2.css
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62; _ga_KZN5DGMJK9=GS1.1.1701647319.1.0.1701647319.0.0.0; _ga=GA1.1.313255608.1701647319
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: image/png
Content-Length: 2957
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:57 GMT
etag: "650bd9c1-b8d"
expires: Sun, 31 Dec 2023 08:37:22 GMT
cache-control: public, max-age=2592000, no-transform
age: 227473
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PE7%2Bnb8nNHGRKAqb6Z%2Bi6e0rcZUDqpRcTAroGUPUjLufGSHuffHYwkVoR9stqeCQ01y9dxdje62spk7OG76EecLQlz%2B8sLTgHZEzSJl2tDWM4Rk%2B%2Bku8k7oi7uKVg2kVpA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3870caa3db1-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/gopay.png
200 OK 4.0 kB URL GET HTTP/1.1 174.138.31.128/assets/img/gopay.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 86 x 25, 8-bit/color RGBA, non-interlaced\012- data
Hash 50248070ce64c8360a5576e782f23e68
a14710eec9377c1200f0af4f13c2518e0d15fcc8
c1e6c3f3fa6029282b8d718f2088fd4dfd5ea272fcb63bc37f95e66df9918df2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/gopay.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: image/png
Content-Length: 4046
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:51 GMT
etag: "650bd9bb-fce"
expires: Tue, 02 Jan 2024 23:48:35 GMT
cache-control: public, max-age=2592000, no-transform
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HRcMKthPo4IDLjWjvGE9Ib2zVHCh5bHkIXRlm9Sskk96Gcb4QF8LBD09o7CxG%2FjoVMoT9ikFrR6WtTtNEkvEV1SqOSG5F9DY0nKCujq%2FRaU8F1T2n1GxZ%2BHqzyMPu0ZIpg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb386e83144a8-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/bni.png
200 OK 1.2 kB URL GET HTTP/1.1 174.138.31.128/assets/img/bni.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 80 x 24, 8-bit colormap, non-interlaced\012- data
Hash f4d6f0960f58c75167c9add1bba9ab55
6a1f672e0cb1261eb33ca01cddd7a4ec4342529a
50afebd206f7b1ef8fcf1d4dff496412a08518bc068319f97465908441cd4041
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/bni.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: image/png
Content-Length: 1242
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:51 GMT
etag: "650bd9bb-4da"
expires: Sun, 31 Dec 2023 01:30:56 GMT
cache-control: public, max-age=2592000, no-transform
age: 253059
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7iOzwlSKVEfSJJrAV1%2FeHGwDAcG38ZyatRSRHdipS8UztpscIx3VdRUAD8ElCwztFXU5rZPQhqh5z24Sk2ZN8Q5zeuuc1RiacNpDynGFzkI4MrJFk6kayZ27pJDJfGBvyg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3870a724044-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/icon/icon-dice%206.jpg
404 Not Found 106 B URL GET HTTP/1.1 174.138.31.128/assets/img/icon/icon-dice%206.jpg
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/icon/icon-dice%206.jpg HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
x-cache: MISS
x-cache-hits: 0
Cache-Control: max-age=14400
CF-Cache-Status: EXPIRED
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DosTq26deJoNLSS%2BjMqTSTRggEpp5EYSMRVuXw3DdOBXDtMdFZrL4E%2B91%2BsagHsBoUbGe2sEu7zRSX9bEesCSoqqfHl1Vz9RbdsD6KJwuzC6TO6ybj%2BsplUSpebtcT9opA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3881a7a3faa-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/img/mandiri.png
200 OK 1.1 kB URL GET HTTP/1.1 174.138.31.128/assets/img/mandiri.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 86 x 25, 8-bit colormap, non-interlaced\012- data
Hash d6370af97aa7f285493a9aecb3e33a42
9a52cc25ace828f731b8790593a2aef19a7b2d23
5e829a18cd9f27940b0bcfd8cbdc4395f368de18d89fd96bf09fcd5cf267a58a
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/mandiri.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: image/png
Content-Length: 1127
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:58 GMT
etag: "650bd9c2-467"
expires: Fri, 08 Dec 2023 01:46:17 GMT
cache-control: public, max-age=2592000, no-transform
age: 2239338
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tII07j1B7ld43xnmvkfRlHrgM%2FO1v9QNrF0xKiMCjw%2BJhNoYJlleQe%2BruEakpz%2BUEwiHDXIPVJ9kvfwVQz2ROh047pp1rSgY93qlfasS494mFCSaa8irh7LXSD%2BQh9AioQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3885a1b91a5-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/ovo.png
200 OK 4.6 kB URL GET HTTP/1.1 174.138.31.128/assets/img/ovo.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 86 x 25, 8-bit/color RGBA, non-interlaced\012- data
Hash 9a8ceefca77b6a4f356bf139e59065b7
fecb95c6ad2fddbcf2424b60a31503917c1cbc02
71dfe3342d07e446916111fed9de1724bdde56c963c1b2573b7ec643e9f26e50
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/ovo.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: image/png
Content-Length: 4578
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:58 GMT
etag: "650bd9c2-11e2"
expires: Mon, 01 Jan 2024 07:05:44 GMT
cache-control: public, max-age=2592000, no-transform
age: 146571
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CGZ3kD2nISrrlmD%2B%2FYXQf3d1%2BkKOu%2BMl4UnZN0aZbA4myfNpQhK9nuCCCo%2F0IxewjcnRpg4A5HfCEmrJKmuA9FjNxFZlptQ5lrwh4iaQUdCV3USlxRmbvaBsxXh0rIfNsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3885f4a6020-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/linkaja.png
200 OK 2.1 kB URL GET HTTP/1.1 174.138.31.128/assets/img/linkaja.png
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 89 x 25, 8-bit/color RGBA, non-interlaced\012- data
Hash 2d5925ab422101ea8f19560ed06cc097
f749f359d92005a41ffce77b9a2d8c5888670f6c
7dfc635cc62e740491850e4bf48ecf3cf0cf21b248f9af8536abac4157156888
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/linkaja.png HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: image/png
Content-Length: 2146
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:58 GMT
etag: "650bd9c2-862"
expires: Fri, 08 Dec 2023 07:11:38 GMT
cache-control: public, max-age=2592000, no-transform
age: 2219817
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BQNTqA%2B2m42EhM1YAnRJnYBsiGOtDqpthYQ0KhYw%2F5taXIO3wh3BsEVIy6yQkpa9IxcIp0y3HlO4DlDt81zdtllj4PpZZN2WSA9mTHIEPb8%2FY%2F1dlcvIJVD86ghUP7FEVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3883f7e4064-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/icon/icon-24d.jpg
200 OK 5.7 kB URL GET HTTP/1.1 174.138.31.128/assets/img/icon/icon-24d.jpg
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x205, components 3\012- data
Hash 68f536efd4d9cf08d6edcaf5ca4d7ced
a4771384bf6e12cc4737cf2f3bbabe27aa503e09
df5bfec8fd98e9195fb9f02960c1f2a06deb9f024dd04801a45b772feffbf5dd
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/icon/icon-24d.jpg HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: image/jpeg
Content-Length: 5662
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:54 GMT
etag: "650bd9be-161e"
expires: Mon, 01 Jan 2024 14:30:07 GMT
cache-control: public, max-age=2592000, no-transform
age: 119908
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KfDAJtUOjqDUwhciON5sHGs899%2Bn%2FxjczBVBD9UpNKzilELsq%2FKtVPfkvquzCuw0r2QN5%2FxJXclHbA6wJoxQrIy7h8klcsk9wtFZ0AH1oBgtnAErjK6s87XdOwSMPqRn3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3888b542e92-SIN
alt-svc: h3=":443"; ma=86400
api.livechatinc.com/v3.5/customer/rtm/ws?organization_id=0859ab0c-966f-4a19-8ee5-858e4d144fe6
0 B URL api.livechatinc.com/v3.5/customer/rtm/ws?organization_id=0859ab0c-966f-4a19-8ee5-858e4d144fe6
IP
ASN #20940 Akamai International B.V.
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v3.5/customer/rtm/ws?organization_id=0859ab0c-966f-4a19-8ee5-858e4d144fe6 HTTP/1.1
Host: api.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://secure.livechatinc.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: ewYBWTtvUNYZIfQXG0tzOQ==
DNT: 1
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
sec-websocket-accept: TJ6vAu+YMTwXI1qwcH+XlLFqwyY=
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://secure.livechatinc.com
Date: Sun, 03 Dec 2023 23:48:35 GMT
Upgrade: websocket
Connection: Upgrade
accounts.livechatinc.com/v2/customer/token
200 OK 195 B URL POST HTTP/2 accounts.livechatinc.com/v2/customer/token
IP
ASN #20940 Akamai International B.V.
Requested by https://secure.livechatinc.com/customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type JSON data\012- , ASCII text
Hash 4542cf2d47cd072763e218760743236a
169aff1783d10c277f52e681135a8d02d3027f58
46a8083bba75c2a585a207947bf71d88556314a48b8da9f6f996dbe30e855d77
POST /v2/customer/token HTTP/1.1
Host: accounts.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 225
Origin: https://secure.livechatinc.com
DNT: 1
Connection: keep-alive
Referer: https://secure.livechatinc.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://secure.livechatinc.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-type: application/json
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
content-length: 195
date: Sun, 03 Dec 2023 23:48:35 GMT
set-cookie: __lc_cid=7e27f4f9-37d4-4965-9e3d-b389ea45e87d; Path=/v2/customer/token; Domain=accounts.livechatinc.com; Expires=Wed, 03 Dec 2025 23:48:35 GMT; Max-Age=63072000; HttpOnly; Secure; SameSite=None
__lc_cst=ed9cb920bae5231997a2f12a579424344ea867e01aa72e6a7aa2d6faa703d0dc577de2adf2e690518a63ac79eac4d7279c079948f791e9304553cde690e6; Path=/v2/customer/token; Domain=accounts.livechatinc.com; Expires=Wed, 03 Dec 2025 23:48:35 GMT; Max-Age=63072000; HttpOnly; Secure; SameSite=None
__lc_cid=7e27f4f9-37d4-4965-9e3d-b389ea45e87d; Path=/customer/token; Domain=accounts.livechatinc.com; Expires=Wed, 03 Dec 2025 23:48:35 GMT; Max-Age=63072000; HttpOnly; Secure; SameSite=None
__lc_cst=ed9cb920bae5231997a2f12a579424344ea867e01aa72e6a7aa2d6faa703d0dc577de2adf2e690518a63ac79eac4d7279c079948f791e9304553cde690e6; Path=/customer/token; Domain=accounts.livechatinc.com; Expires=Wed, 03 Dec 2025 23:48:35 GMT; Max-Age=63072000; HttpOnly; Secure; SameSite=None
__oauth_redirect_detector=counter=1&t=1701647345&tag=95505950a26178436752e345935a739f8a71c750; Path=/; Expires=Sun, 03 Dec 2023 23:49:05 GMT; HttpOnly; Secure; SameSite=None
X-Firefox-Spdy: h2
174.138.31.128/assets/img/icon/icon-roulette.jpg
404 Not Found 106 B URL GET HTTP/1.1 174.138.31.128/assets/img/icon/icon-roulette.jpg
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/icon/icon-roulette.jpg HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
x-cache: MISS
x-cache-hits: 0
Cache-Control: max-age=14400
CF-Cache-Status: EXPIRED
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aB39sBTHDhlt%2B1DpFaFoZdwgZbzLgP9X5MK0N9nQRXBfrEWyL9tNHyONViVDZk%2FIPMq4X5Vspey40vECf3KuJCPwrRkvlXEKZzy3lNbEydA86Dxm3lCXfwUWdJF%2B4KySfA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb3896c7ea030-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/img/icon/icon-sicbo[dice].jpg
404 Not Found 106 B URL GET HTTP/1.1 174.138.31.128/assets/img/icon/icon-sicbo[dice].jpg
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/icon/icon-sicbo[dice].jpg HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
x-cache: MISS
x-cache-hits: 0
Cache-Control: max-age=14400
CF-Cache-Status: EXPIRED
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SjiPLxOsnPb7em7mNYlVVcEgyhlvbaPHzRgGDg5B%2BenisFHVykFc%2B%2FUonkU%2BLa9slknnueFE3CXK1yy9MpDBuzniLcsgx4ak09r%2FRcjJ6j9mjqckDNFDcT8F7QGUucdPjg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb389ac2c9fa9-SIN
alt-svc: h3=":443"; ma=86400
Content-Encoding: gzip
174.138.31.128/assets/img/byw/favicon.png?v=1701647310
200 OK 1.9 kB URL GET HTTP/1.1 174.138.31.128/assets/img/byw/favicon.png?v=1701647310
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced\012- data
Hash f9b4121a761f5f3ffa1f23e5b230a83f
7b518d0784388a6603c7c6bcd7154407d72c728a
2d116f52071d93c06976fb94a030a899aa2d32676978e8b16b33a33056f1ed1e
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/byw/favicon.png?v=1701647310 HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62; _ga_KZN5DGMJK9=GS1.1.1701647319.1.0.1701647319.0.0.0; _ga=GA1.1.313255608.1701647319
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: image/png
Content-Length: 1918
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:58 GMT
etag: "650bd9c2-77e"
expires: Tue, 02 Jan 2024 23:48:31 GMT
cache-control: public, max-age=2592000, no-transform
age: 4
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sn9Nl%2FOfa4odRcuE6J231ijqHqXT9tLCtSspMbiuliE0mZ95rUuHFym7LDgC7C%2BdIR7dU7l4N0LMCJWJfZz%2FIuoNp5Ea6ly0s9wo%2F5yMUMZO%2B6WF923CqHRDQaSC8%2BqUJg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb38bab786bdf-SIN
alt-svc: h3=":443"; ma=86400
174.138.31.128/assets/img/icon/icon-toto%20macau.jpg
200 OK 52 kB URL GET HTTP/1.1 174.138.31.128/assets/img/icon/icon-toto%20macau.jpg
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerSectigo Limited
Subject174.138.31.128
Fingerprint65:AF:24:7B:FD:63:04:41:B3:DC:09:49:4C:55:C6:7E:0C:E0:DB:2E
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x205, components 3\012- data
Hash 1aa941152037ed686d532ae5691731d7
8222036a29fa540a55dbfc2cfff401b12d5cfcf4
44afa7bac070be11a25113dd4ced630691439d7801bb9fbaf0b2251776d1e558
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /assets/img/icon/icon-toto%20macau.jpg HTTP/1.1
Host: 174.138.31.128
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Cookie: laravel_session=eyJpdiI6Ik5wNlFUQXU3dXNNTFM2c2kwdWFFdnc9PSIsInZhbHVlIjoic3NtQy9XY1VMeUZQbmx1VzZBOEZCV0NkZ2xucWlZcEF2bkxCK2tjNUVjODY5Zjd6WjUvOXRpemswMXV6OGMwYWVyVldTWHFVanZPemdDSHZIRWhBU21seS9HUnJScFFXUThya28yQjMvZEg5ZWtDYXkzWFlaUVdCeVJXN1JJZ201ckNuRko5QnVJNHZQN2pDR0dCZlVEUWtWN3hCRkVPaHp4MUpFbFNKN25yOWdOWElOTHVjeXRRODlrTEFLc3Q1OHNNSXlOblJhRE5sb0hncWpmM0toMk96dVFhR0VtR1RzZTYzcjF1azM5QlI4SzUwUXQxeSs5MC9pRmhveU1WNGF1Nmt0eW5KSm0vM09DTkxsNXNJcmo4MVVmK0hnWjFpWGtXdVEyNk41cHQ4Tkp5bWZabW5Ha2VxZnZNRXFEYVZlRDRCTWlJUkREenIyWTBQTDVxak5FekNWelZ2MnlQSGNrQW14aW9kZkVxZUhOTmZPZzFrSFVaQ0w3bmFXL3ExUXNGem5raFdzeTA4bmlldnpIYXplSkhxcWMrVms2Q2RJWTdCbHpZMzEvZWlKcHBCbUd1dEVuZkFXV3U2am5XamEyenJoaGpnTncvQjRSQ3JjODVmZDgvWit3M09Ec3o4VjVhM21DUG56T2tSZ0VzUzlBMUwycWpaUVlnUXRBZk4iLCJtYWMiOiJlMWFiMGVhNGIwMzE3YjJmZWQyYWM3Y2YzZTEwZWZhMGQ4NmZhMTFlZmU4OTBkNjEyMzdhMWI4YmVlZGEwZTllIiwidGFnIjoiIn0%3D; SRVNAME=62
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Sun, 03 Dec 2023 23:48:35 GMT
Content-Type: image/jpeg
Content-Length: 52505
Connection: keep-alive
last-modified: Thu, 21 Sep 2023 05:50:53 GMT
etag: "650bd9bd-cd19"
expires: Mon, 01 Jan 2024 11:18:27 GMT
cache-control: public, max-age=2592000, no-transform
age: 131408
x-cache: MISS
x-cache-hits: 0
CF-Cache-Status: HIT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dxPgDhZkYWUWOrHNzJq0UIFHlVXDI0MTxfMGLGLXlPLuk%2BpmpxkCy3nK9828Z%2FvRwvi%2Bl07QUbzlM2VcHD8k%2B38m7Ts0w7LsWzWUZ1Y9SZ%2BkX5q2VHJPSUEjcEjRp8mT%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 82ffb38838014070-SIN
alt-svc: h3=":443"; ma=86400
cdn.livechat-files.com/api/file/lc/main/15438312/0/ec/ace22bf3c26cc1b66c8b7bbe9cc7f74b.gif
200 OK 596 kB URL GET HTTP/2 cdn.livechat-files.com/api/file/lc/main/15438312/0/ec/ace22bf3c26cc1b66c8b7bbe9cc7f74b.gif
IP
ASN #20940 Akamai International B.V.
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type GIF image data, version 89a, 200 x 240\012- data
Size 596 kB (596401 bytes)
Hash 9c67dfe88ed39e6d6144f598930997b2
fdd52b19d7da7d7fffccd1784b3803badd2649c0
e7ae4ac57ef10d042a7c5b790bdef8400b6bd7c24e378feb6eb34d205d063686
GET /api/file/lc/main/15438312/0/ec/ace22bf3c26cc1b66c8b7bbe9cc7f74b.gif HTTP/1.1
Host: cdn.livechat-files.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-length: 596401
content-type: image/gif
cache-control: private, max-age=86385
date: Sun, 03 Dec 2023 23:48:36 GMT
set-cookie: FASID=FA1-DAL10|ZW0T1; path=/; Secure; SameSite=None
access-control-allow-origin: *
X-Firefox-Spdy: h2
cdn.livechatinc.com/widget/static/js/3.0421d3eb.chunk.js
200 OK 12 kB URL GET HTTP/2 cdn.livechatinc.com/widget/static/js/3.0421d3eb.chunk.js
IP
ASN #20940 Akamai International B.V.
Requested by https://secure.livechatinc.com/customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (38181), with no line terminators
Hash 31bae3f2c8d65f52ff0734b19f33327a
03df2f9c9c1a8f8303f282fe5c5c262ff9a7ed10
510d6e321b68abc215ced3680b4e694289b770d88094160989da5947725a076e
GET /widget/static/js/3.0421d3eb.chunk.js HTTP/1.1
Host: cdn.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://secure.livechatinc.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 23 Nov 2023 10:38:12 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: fdSGeX80_jEWxLJH2T00DhJWhFHoJTZ4
server: AmazonS3
content-encoding: br
etag: W/"31bae3f2c8d65f52ff0734b19f33327a"
vary: Accept-Encoding
x-amz-cf-pop: AMS58-P4
x-amz-cf-id: M7Lwid_YiGVdRNgQ9FKkJHY4yNmnMuUUnH4bwoS5wJJUEWWZB0LTsw==
content-length: 11719
cache-control: max-age=31536000
expires: Mon, 02 Dec 2024 23:48:38 GMT
date: Sun, 03 Dec 2023 23:48:38 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
X-Firefox-Spdy: h2
cdn.livechatinc.com/widget/static/js/2.3f70e353.chunk.js
200 OK 24 kB URL GET HTTP/2 cdn.livechatinc.com/widget/static/js/2.3f70e353.chunk.js
IP
ASN #20940 Akamai International B.V.
Requested by https://secure.livechatinc.com/customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Hash 384127bad72b122f6934f94b006fd70b
99905cdcc8ab19b3d93ae37184821d14976820d7
caeda0f548c872382acbb1eb729220b39fcff4821592078058c08a61f46dc0ed
GET /widget/static/js/2.3f70e353.chunk.js HTTP/1.1
Host: cdn.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://secure.livechatinc.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
last-modified: Fri, 24 Nov 2023 12:28:05 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: 9geY1vG.MwuVzcVlgHjs6Abq.4zWvPBQ
server: AmazonS3
content-encoding: br
etag: W/"384127bad72b122f6934f94b006fd70b"
vary: Accept-Encoding
x-amz-cf-pop: AMS58-P4
x-amz-cf-id: yUJCsnC3LUasiDJIvnxrn0N7Te01K5hSJYc0KHGXz_Fuv3KxjfVDLA==
content-length: 24132
cache-control: max-age=31536000
expires: Mon, 02 Dec 2024 23:48:38 GMT
date: Sun, 03 Dec 2023 23:48:38 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
X-Firefox-Spdy: h2
cdn.livechatinc.com/widget/static/js/6.8e61c078.chunk.js
200 OK 5.6 kB URL GET HTTP/2 cdn.livechatinc.com/widget/static/js/6.8e61c078.chunk.js
IP
ASN #20940 Akamai International B.V.
Requested by https://secure.livechatinc.com/customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (15837), with no line terminators
Hash e2fea0a176f2c4334ab3dbb8370facfb
a9564cbb25d9ae10ce33283bd60a4b8258545272
d622d47e662202954709a7b9551c3662569c795ef5ddd650d15e35ea81b9a752
GET /widget/static/js/6.8e61c078.chunk.js HTTP/1.1
Host: cdn.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://secure.livechatinc.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 23 Nov 2023 10:38:13 GMT
etag: W/"e2fea0a176f2c4334ab3dbb8370facfb"
x-amz-server-side-encryption: AES256
x-amz-version-id: bKVfT5OTwMcDV77xVMCHlUVfnSajl2NS
server: AmazonS3
content-encoding: br
vary: Accept-Encoding
x-amz-cf-pop: ARN1-C1
x-amz-cf-id: ozWRbgKhaOvFQBc7k5pAI9YvjNuuevG2DW8UD_hmwlm7aXiprDZImA==
content-length: 5561
cache-control: max-age=31536000
expires: Mon, 02 Dec 2024 23:48:38 GMT
date: Sun, 03 Dec 2023 23:48:38 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
X-Firefox-Spdy: h2
cdn.livechatinc.com/widget/static/js/main-view.ab2024bf.chunk.js
200 OK 28 kB URL GET HTTP/2 cdn.livechatinc.com/widget/static/js/main-view.ab2024bf.chunk.js
IP
ASN #20940 Akamai International B.V.
Requested by https://secure.livechatinc.com/customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Hash a0b197c29ec6af354abd3bfe8fa993cd
43b646270ff9b70d56caed7f57813baeebd9bc90
c30ba77db9c5aadb0a3c6a4cd8db9e6f8a2b951d6de0cc11e267b04868c6c660
GET /widget/static/js/main-view.ab2024bf.chunk.js HTTP/1.1
Host: cdn.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://secure.livechatinc.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
last-modified: Thu, 23 Nov 2023 11:13:26 GMT
etag: W/"a0b197c29ec6af354abd3bfe8fa993cd"
x-amz-server-side-encryption: AES256
x-amz-version-id: YoJW5XonjedaMvHNEsUdpG62Zy9InqtM
server: AmazonS3
content-encoding: br
vary: Accept-Encoding
x-amz-cf-pop: AMS58-P4
x-amz-cf-id: V4ReyaK2fZThMOmxKxpfyi43nRhQ62_usT1K1urv5BPFpnK6ALYMXg==
content-length: 27799
cache-control: max-age=31536000
expires: Mon, 02 Dec 2024 23:48:38 GMT
date: Sun, 03 Dec 2023 23:48:38 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
X-Firefox-Spdy: h2
cdn.livechat-files.com/api/file/lc/main/default/logo/sz2tt7jpJ6VJwBo.png
200 OK 9.3 kB URL GET HTTP/2 cdn.livechat-files.com/api/file/lc/main/default/logo/sz2tt7jpJ6VJwBo.png
IP
ASN #20940 Akamai International B.V.
Requested by https://secure.livechatinc.com/customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced\012- data
Hash 7feb9b237bfabbdeffe5d876287c4b8b
22182b82921a8d5d30d10097e2b0b91bafe8d840
a47bc774d9370d98fde762fd42b24cd2bc199b093c90d2a30a24cf358f66d2f0
GET /api/file/lc/main/default/logo/sz2tt7jpJ6VJwBo.png HTTP/1.1
Host: cdn.livechat-files.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://secure.livechatinc.com/
Cookie: FASID=FA1-DAL10|ZW0T1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-length: 9288
content-type: image/png
cache-control: private, max-age=15149
date: Sun, 03 Dec 2023 23:48:38 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2
cdn.livechat-files.com/api/file/lc/img/15438312/9ff3bc082159aa48bbf1669357599b34.jpeg
200 OK 7.0 kB URL GET HTTP/2 cdn.livechat-files.com/api/file/lc/img/15438312/9ff3bc082159aa48bbf1669357599b34.jpeg
IP
ASN #20940 Akamai International B.V.
Requested by https://secure.livechatinc.com/customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 0x0, segment length 16, baseline, precision 8, 225x225, components 3\012- data
Hash 5712d261434159cda18c34950cb861c8
2c2c18c25b865a1a8c7a6d066d8d27932b58ff13
a50c5310abbe44a4d3c3a468dd931e96880521f2c17afebf492f6a6e74d4b3b3
GET /api/file/lc/img/15438312/9ff3bc082159aa48bbf1669357599b34.jpeg HTTP/1.1
Host: cdn.livechat-files.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://secure.livechatinc.com/
Cookie: FASID=FA1-DAL10|ZW0T1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-length: 6990
content-type: image/jpeg
cache-control: private, max-age=86329
date: Sun, 03 Dec 2023 23:48:39 GMT
set-cookie: FASID=FA1-DAL10|ZW0T2; path=/; Secure; SameSite=None
access-control-allow-origin: *
X-Firefox-Spdy: h2
301 Moved Permanently 101 kB URL User Request GET HTTP/2 IP
Certificate IssuerGoogle Trust Services LLC
Subjectwisatapaus.site
Fingerprint5C:2D:BE:28:A8:29:91:FD:8E:C8:24:59:D8:70:F3:5E:54:0E:C3:4D
ValidityFri, 13 Oct 2023 19:02:18 GMT - Thu, 11 Jan 2024 19:02:17 GMT
Size 101 kB (101299 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: wisatapaus.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Sun, 03 Dec 2023 23:48:29 GMT
location: https://174.138.31.128/
cache-control: max-age=3600
expires: Mon, 04 Dec 2023 00:48:29 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gI4ozpq9QOuGe%2BnxWvVqSpjrUvPevN68lhDnLa94qFzh6HJiqq5dQ%2BxhGt6TKm2K3C%2FT7Me4HR7OLn5%2B5CbntxrhPJyBqy6Mb7IBbFasT9NzOF0SkIy9Jc06dtT%2BKDN9BZE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ffb366fe307127-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
api.livechatinc.com/v3.5/customer/rtm/ws?organization_id=0859ab0c-966f-4a19-8ee5-858e4d144fe6
101 Switching Protocols 0 B URL GET HTTP/1.1 api.livechatinc.com/v3.5/customer/rtm/ws?organization_id=0859ab0c-966f-4a19-8ee5-858e4d144fe6
IP
ASN #20940 Akamai International B.V.
Requested by https://secure.livechatinc.com/customer/action/open_chat?license_id=15438312&group=0&embedded=1&widget_version=3&unique_groups=0
Certificate IssuerDigiCert Inc
Subjectlivechat.com
Fingerprint76:42:79:92:87:C7:74:BC:5B:DC:11:4E:54:69:70:2A:5F:78:41:8F
ValidityWed, 16 Aug 2023 00:00:00 GMT - Thu, 15 Aug 2024 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v3.5/customer/rtm/ws?organization_id=0859ab0c-966f-4a19-8ee5-858e4d144fe6 HTTP/1.1
Host: api.livechatinc.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://secure.livechatinc.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: ewYBWTtvUNYZIfQXG0tzOQ==
DNT: 1
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
sec-websocket-accept: TJ6vAu+YMTwXI1qwcH+XlLFqwyY=
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://secure.livechatinc.com
Date: Sun, 03 Dec 2023 23:48:35 GMT
Upgrade: websocket
Connection: Upgrade
semitotopools1.site/wisatatoto/bgwisata.png
200 OK 1.6 MB URL GET HTTP/2 semitotopools1.site/wisatatoto/bgwisata.png
IP
Certificate IssuerLet's Encrypt
Subjectsemitotopools1.site
FingerprintEC:BE:38:93:87:52:73:6B:B2:60:93:36:46:13:60:F4:71:2A:3B:6C
ValidityMon, 27 Nov 2023 15:59:41 GMT - Sun, 25 Feb 2024 15:59:40 GMT
Size 1.6 MB (1579120 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /wisatatoto/bgwisata.png HTTP/1.1
Host: semitotopools1.site
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://174.138.31.128/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 03 Dec 2023 23:48:34 GMT
content-type: image/png
content-length: 1579120
cache-control: public, max-age=604800
expires: Sun, 10 Dec 2023 23:48:33 GMT
last-modified: Fri, 13 Oct 2023 18:26:37 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WXCGEwUDgoDWOH1AQhDbAlHAjyG9A3OSYibMJuG6%2BTZ8OmrPiUcRKkaZbue3oQ%2F%2FxoV%2BuHQI3tyU9VI67GITZUx7O7hpJZlDl2vbMCwPjNmyg4Yuc%2F2ITv7wNHYrOTl1cNzX3ADt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 82ffb37cae731c06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
104.21.67.223
162.19.58.158
216.58.207.227
23.36.79.17
174.138.31.128
188.114.96.1